8.1high
CVE-2016-6633
phpMyAdmin Remote code execution vulnerability when PHP is running with dbase extension
Also known as GHSA-p849-vf5f-f3x7
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.0%
percentile 91%
Public exploits
0
none known
Summary
An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Exploit prediction (EPSS)
3.97% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | phpmyadmin/phpmyadmin | >=4.6, <4.6.4 >=4.4, <4.4.15.8 >=4.0, <4.0.10.17 | 4.6.4 4.4.15.8 4.0.10.17 |
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- securityfocus.com /bid/92500 · vdb-entry, x_refsource_BID, x_transferred
- phpmyadmin.net /security/PMASA-2016-56 · x_refsource_CONFIRM, x_transferred
- security.gentoo.org /glsa/201701-32 · vendor-advisory, x_refsource_GENTOO, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-6633 · advisory
- github.com /phpmyadmin/composer · package
Sources
- CVE List: CVE-2016-6633
- GitHub Advisory: GHSA-p849-vf5f-f3x7
- NVD: CVE-2016-6633
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.