vulnwire
5.4med

CVE-2016-2559

phpMyAdmin Cross-site scripting (XSS) vulnerability in SQL parser

Also known as GHSA-7rf8-9r8f-qf59

Published 10 y ago · modified 4 mo ago · JSON

CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known

Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.

Exploit prediction (EPSS)

1.71% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N
GitHub3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistphpmyadmin/phpmyadmin
>=4.5, <4.5.5.1
4.5.5.1

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • phpmyadmin.net /security/PMASA-2016-10/ · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-March/178562.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • github.com /phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-March/178869.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-2559 · advisory
  • github.com /phpmyadmin/composer · package
  • phpmyadmin.net /security/PMASA-2016-10 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.