CVE-2016-9864
Summary
| CVE | CVE-2016-9864 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-12-11 03:00:06 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. |
Risk And Classification
Primary CVSS: v3.0 7.5 HIGH from [email protected]
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.004360000 probability, percentile 0.630920000 (date 2026-05-11)
Problem Types: CWE-89 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 6 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Phpmyadmin | Phpmyadmin | 4.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.10 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.11 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.12 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.13 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.14 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.15 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.16 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.17 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.10.9 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.4.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.4.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.0.9 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.1.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.10 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.11 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.12 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.13 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.13.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.14 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.14.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.15.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.6.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.4.9 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 4.6.4 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] [DLA 1821-1] phpmyadmin security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| phpMyAdmin - Security - PMASA-2016-69 | af854a3a-2127-422b-91ae-364da2661108 | www.phpmyadmin.net | Patch, Vendor Advisory |
| phpMyAdmin PMASA-2016-69 Multiple SQL Injection Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| phpMyAdmin: Multiple vulnerabilities (GLSA 201701-32) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.