An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-12-11T02:00:00

Updated: 2024-08-06T02:59:03.561Z

Reserved: 2016-12-06T00:00:00

Link: CVE-2016-9864

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2016-12-11T03:00:06.057

Modified: 2024-11-21T03:01:54.817

Link: CVE-2016-9864

cve-icon Redhat

No data.