phpMyAdmin <4.0.10.16, <4.4.15.7, <4.6.3 - RCE
Title source: llmExploitation Summary
CVE-2016-5734 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 5 public exploits from researchers including @iamsecurity, miko550, HKirito, including a Metasploit module exploits/multi/http/phpmyadmin_null_termination_exec.
AI-analyzed exploit summary This exploit leverages a regex null byte vulnerability in phpMyAdmin 4.3.0-4.6.2 to achieve remote code execution (RCE) by manipulating the find-and-replace functionality. It requires valid credentials and targets PHP versions 4.3.0-5.4.6 due to a regex fix in later versions.
Description
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
Exploits (5)
This exploit leverages a regex null byte vulnerability in phpMyAdmin 4.3.0-4.6.2 to achieve remote code execution (RCE) by manipulating the find-and-replace functionality. It requires valid credentials and targets PHP versions 4.3.0-5.4.6 due to a regex fix in later versions.
This repository contains a functional exploit for CVE-2016-5734, a remote code execution vulnerability in phpMyAdmin 4.0.x-4.6.2. The exploit leverages a find-and-replace feature with a crafted regex to inject malicious PHP code into a database table, which is then executed.
This is a functional exploit for CVE-2016-5734, targeting a regex-based vulnerability in phpMyAdmin 4.3.0-4.6.2. It leverages a null byte injection in the find-and-replace feature to achieve remote code execution (RCE) when combined with valid credentials.
This repository contains Ansible playbooks for setting up a test environment but lacks any exploit code or technical details related to CVE-2016-5734. It appears to be a placeholder or incomplete project.
This Metasploit module exploits a preg_replace eval injection vulnerability in phpMyAdmin (CVE-2016-5734) to achieve authenticated remote code execution. It leverages improper delimiter handling in the search-and-replace functionality to inject arbitrary PHP code.
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H