CVE Vulnerabilities

CVE-2016-5701

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Jul 03, 2016 | Modified: Oct 30, 2018
CVSS 3.x
6.1
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Phpmyadmin Phpmyadmin 4.0.10.15 4.0.10.15
Phpmyadmin Phpmyadmin 4.0.0 4.0.0
Phpmyadmin Phpmyadmin 4.0.5 4.0.5
Phpmyadmin Phpmyadmin 4.0.3 4.0.3
Phpmyadmin Phpmyadmin 4.0.10.10 4.0.10.10
Phpmyadmin Phpmyadmin 4.0.10.13 4.0.10.13
Phpmyadmin Phpmyadmin 4.0.7 4.0.7
Phpmyadmin Phpmyadmin 4.0.10 4.0.10
Phpmyadmin Phpmyadmin 4.0.10.4 4.0.10.4
Phpmyadmin Phpmyadmin 4.0.8 4.0.8
Phpmyadmin Phpmyadmin 4.0.2 4.0.2
Phpmyadmin Phpmyadmin 4.0.10.1 4.0.10.1
Phpmyadmin Phpmyadmin 4.0.10.14 4.0.10.14
Phpmyadmin Phpmyadmin 4.0.6 4.0.6
Phpmyadmin Phpmyadmin 4.0.10.9 4.0.10.9
Phpmyadmin Phpmyadmin 4.0.4.1 4.0.4.1
Phpmyadmin Phpmyadmin 4.0.1 4.0.1
Phpmyadmin Phpmyadmin 4.0.10.7 4.0.10.7
Phpmyadmin Phpmyadmin 4.0.10.6 4.0.10.6
Phpmyadmin Phpmyadmin 4.0.10.3 4.0.10.3
Phpmyadmin Phpmyadmin 4.0.4.2 4.0.4.2
Phpmyadmin Phpmyadmin 4.0.10.11 4.0.10.11
Phpmyadmin Phpmyadmin 4.0.10.5 4.0.10.5
Phpmyadmin Phpmyadmin 4.0.10.12 4.0.10.12
Phpmyadmin Phpmyadmin 4.0.9 4.0.9
Phpmyadmin Phpmyadmin 4.0.4 4.0.4
Phpmyadmin Phpmyadmin 4.0.10.8 4.0.10.8
Phpmyadmin Phpmyadmin 4.0.10.2 4.0.10.2

Potential Mitigations

References