Description
SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
References (6)
Core 6
Core References
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html
Patch x_refsource_confirm
https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3
Patch, Vendor Advisory x_refsource_confirm
https://www.phpmyadmin.net/security/PMASA-2016-19/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/91381
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201701-32
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html
Scores
CVSS v3
9.8
EPSS
0.0158
EPSS Percentile
81.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (31)
opensuse/leap
42.1
opensuse/opensuse
13.1
opensuse/opensuse
13.2
phpmyadmin/phpmyadmin
4.4.0
phpmyadmin/phpmyadmin
4.4.1
phpmyadmin/phpmyadmin
4.4.1.1
phpmyadmin/phpmyadmin
4.4.2
phpmyadmin/phpmyadmin
4.4.3
phpmyadmin/phpmyadmin
4.4.4
phpmyadmin/phpmyadmin
4.4.5
... and 21 more
Published
Jul 03, 2016
Tracked Since
Feb 18, 2026