CVE-2016-5703 SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted data...
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/phpmyadmin(Debian:12) | < 4:4.6.3-1 | 4:4.6.3-1 |
| debian/phpmyadmin(Debian:13) | < 4:4.6.3-1 | 4:4.6.3-1 |
| debian/phpmyadmin(Debian:14) | < 4:4.6.3-1 | 4:4.6.3-1 |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.1.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.6.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.9 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.10 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.11 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.12 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.13 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.13.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.14.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin | = 4.4.15.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.5 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.4.15.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.0-alpha1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.0-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.0-rc2 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 4.6.2 | No fix listed |
References
- Debian Security Tracker CVE-2016-5703 vendor-advisory
- openSUSE-SU-2016:1699 vendor-advisory
- openSUSE-SU-2016:1700 vendor-advisory
- 91381 vdb-entry
- github.com patch
- GLSA-201701-32 vendor-advisory
- www.phpmyadmin.net patch vendor-advisory