GitHub Advisoryadvisory · Packagist

GHSA-p849-vf5f-f3x7 phpMyAdmin Remote code execution vulnerability when PHP is running with dbase extension

HIGH Published 2022-05-17 Modified 2024-04-24 Official page ↗
Aliases
CVE-2016-6633
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-04-24

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 4.6, < 4.6.4 → fixed in 4.6.4 • Packagist phpmyadmin/phpmyadmin: >= 4.4, < 4.4.15.8 → fixed in 4.4.15.8 • Packagist phpmyadmin/phpmyadmin: >= 4.0, < 4.0.10.17 → fixed in 4.0.10.17

Description

An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Related

Alias · CVE (1)

  • CVE-2016-6633 An issue was discovered in phpMyAdmin. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References