CVE-2016-9849
Summary
| CVE | CVE-2016-9849 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-12-11 02:59:47 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. |
Risk And Classification
Primary CVSS: v3.0 9.8 CRITICAL from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.002170000 probability, percentile 0.440200000 (date 2026-05-11)
Problem Types: CWE-264 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Phpmyadmin | Phpmyadmin | 4.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.10 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.11 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.12 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.13 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.14 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.15 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.16 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.17 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.9 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.4.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.4.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.9 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.1.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.10 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.11 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.12 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.13 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.13.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.14 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.14.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.6.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.9 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.4 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 1821-1] phpmyadmin security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| phpMyAdmin PMASA-2016-60 Remote Multiple Security Bypass Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| phpMyAdmin - Security - PMASA-2016-60 | af854a3a-2127-422b-91ae-364da2661108 | www.phpmyadmin.net | Patch, Vendor Advisory |
| phpMyAdmin: Multiple vulnerabilities (GLSA 201701-32) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.