CVE-2016-9866

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x prior to 4.0.10.18 phpMyAdmin versions 4.4.x prior to 4.4.15.9 phpMyAdmin versions 4.6.x prior to 4.6.5

Description An issue was discovered in phpMyAdmin. When the arg separator is different from its default '&' value, the CSRF token was not properly stripped from the return URL of the preference import action.

Recommendations For versions 4.0.x prior to 4.0.10.18, update to version 4.0.10.18 or later. For versions 4.4.x prior to 4.4.15.9, update to version 4.4.15.9 or later. For versions 4.6.x prior to 4.6.5, update to version 4.6.5 or later.