{"id":"CVE-2016-9849","aliases":["ALPINE-CVE-2016-9849","DEBIAN-CVE-2016-9849","DLA-1821-1","DLA-757-1","EUVD-2016-10648","GHSA-r6w3-53hv-rjhw","MGASA-2016-0416","UBUNTU-CVE-2016-9849","USN-4843-1","openSUSE-SU-2024:10054-1"],"status":"published","title":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg[...","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02672,"percentile":0.85862,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2016-12-09T08:42:46Z","modified":"2026-10-24T10:30:39Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"phpmyadmin","fixed_in":["4.4.15.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"phpmyadmin","fixed_in":["4.6.5.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:4.6.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:4.6.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:4.6.5.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","fixed_in":["4:4.0.10-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","fixed_in":["4:4.5.4.1-2ubuntu2.1+esm5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.15.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.2.12-2+deb8u6"}]}],"versions":["4:4.2.12-2","4:4.2.12-2+deb8u1","4:4.2.12-2+deb8u2","4:4.2.12-2+deb8u3","4:4.2.12-2+deb8u4","4:4.2.12-2+deb8u5"],"bundled":16},{"source":"osv","ecosystem":"Debian:7","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:3.4.11.1-2+deb7u7"}]}],"versions":["4:3.4.11.1-2","4:3.4.11.1-2+deb7u1","4:3.4.11.1-2+deb7u2","4:3.4.11.1-2+deb7u3","4:3.4.11.1-2+deb7u4","4:3.4.11.1-2+deb7u5","4:3.4.11.1-2+deb7u6"],"bundled":7},{"source":"osv","ecosystem":"Mageia:5","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.15.9-1.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.0.10-1ubuntu0.1+esm3"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4.1-2ubuntu2.1+esm5"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.0.10-1ubuntu0.1+esm4"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.5.4.1-2ubuntu2.1+esm6"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.6.6-5ubuntu0.5+esm1"}]}],"versions":["4:4.6.6-5","4:4.6.6-5ubuntu0.2+esm1","4:4.6.6-5ubuntu0.2+esm2","4:4.6.6-5ubuntu0.5"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:4.9.5+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2"],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5.2-1.1"}]}],"bundled":124}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"http://www.securityfocus.com/bid/94521","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-60","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/201701-32","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9849"},{"url":"https://github.com/advisories/GHSA-r6w3-53hv-rjhw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-9849","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9849","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0416.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19841","tags":["report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-58/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-59/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-60/","tags":["web","report"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-61/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-62/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-63/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-64/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-65/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-66/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-69/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-70/","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2016-71/","tags":["web"]},{"url":"https://www.phpmyadmin.net/files/4.4.15.9/","tags":["web"]},{"url":"https://www.phpmyadmin.net/news/2016/11/25/phpmyadmin-401018-44159-and-465-are-released/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9849","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9849","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4843-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9218","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6609","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6630","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9866","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-18264","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000015","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-7260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12581","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6798","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11768","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12922","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-19617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-5504","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-26935","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-4345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-6300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9866","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9849","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:00:00Z","modified":"2024-08-06T02:59:03.53Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-10648","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:00:00Z","modified":"2024-08-06T02:59:03Z","updated_at":"2026-11-03T02:22:26.376959Z"}],"ghsa":[{"id":"GHSA-r6w3-53hv-rjhw","title":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg[...","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2022-05-17T02:36:38Z","modified":"2023-01-27T05:05:31Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:42:42.951341Z"}],"nvd":[{"id":"CVE-2016-9849","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:59:47.083Z","modified":"2026-06-17T00:56:39.923Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"ALPINE-CVE-2016-9849","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:59:47.083Z","modified":"2026-09-22T06:30:43.631791433Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2016-9849","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:59:47.083Z","modified":"2026-10-24T10:30:39.978857585Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2016-9849","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:59:47.083Z","modified":"2026-09-22T07:00:53.95343941Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9849","description":"An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.","status":"published","published":"2016-12-11T02:59:00Z","modified":"2026-02-04T03:48:41.785705Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DLA-1821-1","title":"phpmyadmin - security update","status":"published","published":"2019-06-16T00:00:00Z","modified":"2026-03-09T01:19:55.166214Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-757-1","title":"phpmyadmin - security update","status":"published","published":"2016-12-22T00:00:00Z","modified":"2026-03-09T02:09:52.317531Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0416","title":"Updated phpmyadmin packages fix security vulnerability","description":"In phpMyAdmin before 4.4.15.9, when the user does not specify a\nblowfish_secret key for encrypting cookies, phpMyAdmin generates one at\nruntime. A vulnerability was reported where the way this value is created\nusing a weak algorithm. This could allow an attacker to determine the\nuser's blowfish_secret and potentially decrypt their cookies\n(CVE-2016-9847).\n\nIn phpMyAdmin before 4.4.15.9, phpinfo.php shows PHP information including\nvalues of sensitive HttpOnly cookies (CVE-2016-9848).\n\nIn phpMyAdmin before 4.4.15.9, it is possible to bypass AllowRoot\nrestriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username\nby using Null Byte in the username (CVE-2016-9849).\n\nIn phpMyAdmin before 4.4.15.9, a vulnerability in username matching for\nthe allow/deny rules may result in wrong matches and detection of the\nusername in the rule due to non-constant execution time (CVE-2016-9850).\n\nIn phpMyAdmin before 4.4.15.9, with a crafted request parameter value it\nis possible to bypass the logout timeout (CVE-2016-9851).\n\nIn phpMyAdmin before 4.4.15.9, by calling some scripts that are part of\nphpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to\ndisplay a PHP error message which contains the full path of the directory\nwhere phpMyAdmin is installed. During an execution timeout in the export\nfunctionality, the errors containing the full path of the directory of\nphpMyAdmin is written to the export file (CVE-2016-9852, CVE-2016-9853,\nCVE-2016-9854, CVE-2016-9855).\n\nIn phpMyAdmin before 4.4.15.9, several XSS vulnerabilities have been\nreported, including an improper fix for PMASA-2016-10 and a weakness in a\nregular expression using in some JavaScript processing (CVE-2016-9856,\nCVE-2016-9857).\n\nIn phpMyAdmin before 4.4.15.9, with a crafted request parameter value it\nis possible to initiate a denial of service attack in saved searches\nfeature (CVE-2016-9858).\n\nIn phpMyAdmin before 4.4.15.9, with a crafted request parameter value it\nis possible to initiate a denial of service attack in import feature\n(CVE-2016-9859).\n\nIn phpMyAdmin before 4.4.15.9, an unauthenticated user can execute a\ndenial of service attack when phpMyAdmin is running with\n$cfg['AllowArbitraryServer']=true; (CVE-2016-9860).\n\nIn phpMyAdmin before 4.4.15.9, due to the limitation in URL matching, it\nwas possible to bypass the URL white-list protection (CVE-2016-9861).\n\nIn phpMyAdmin before 4.4.15.9, with a crafted username or a table name,\nit was possible to inject SQL statements in the tracking functionality\nthat would run with the privileges of the control user. This gives read\nand write access to the tables of the configuration storage database, and\nif the control user has the necessary privileges, read access to some\ntables of the mysql database (CVE-2016-9864).\n\nIn phpMyAdmin before 4.4.15.9, due to a bug in serialized string parsing,\nit was possible to bypass the protection offered by PMA_safeUnserialize()\nfunction (CVE-2016-9865).\n\nIn phpMyAdmin before 4.4.15.9, when the arg_separator is different from\nits default value of \u0026, the token was not properly stripped from the\nreturn URL of the preference import action (CVE-2016-9866).\n","status":"published","published":"2016-12-09T08:42:46Z","modified":"2026-04-16T06:24:49.462450754Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10054-1","title":"phpMyAdmin-4.6.5.2-1.1 on GA media","description":"These are all security issues fixed in the phpMyAdmin-4.6.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:59.433224Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"USN-4843-1","title":"phpmyadmin vulnerabilities","description":"Javier Nieto and Andres Rojas discovered that phpMyAdmin incorrectly\nmanaged input in the form of passwords. An attacker could use this\nvulnerability to cause a denial-of-service (DoS). This issue only\naffected Ubuntu 14.04 ESM. (CVE-2014-9218)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of database names in the PHP Array export feature.\nAn authenticated attacker could use this vulnerability to run arbitrary\nPHP commands. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6609)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2016-6619)\n\nEmanuel Bronshtein discovered that phpMyadmin failed to properly sanitize\ninput. An authenticated attacker could use this vulnerability to cause a\ndenial-of-service (DoS). This issue only affected Ubuntu 14.04 ESM and\nUbuntu 16.04 ESM. (CVE-2016-6630)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput. An attacker could use this vulnerability to bypass AllowRoot\nrestrictions and deny rules for usernames. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9849)\n\nEmanuel Bronshtein discovered that phpMyAdmin would allow sensitive\ninformation to be leaked when the argument separator in a URL was\nnot the default \u0026 value. An attacker could use this vulnerability to\nobtain the CSRF token of a user. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2016-9866)\n\nIsaac Bennetch discovered that phpMyAdmin was incorrectly restricting\nuser access due to the behavior of the substr function on some PHP\nversions. An attacker could use this vulnerability to bypass login\nrestrictions established for users that have no password set. This\nissue only affected Ubuntu 14.04 ESM. This issue only affected Ubuntu\n14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-18264)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput in the form of parameters sent during a table editing operation. An\nattacker could use this vulnerability to trigger an endless recursion\nand cause a denial-of-service (DoS). This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2017-1000014)\n\nEmanuel Bronshtein discovered that phpMyAdmin failed to properly sanitize\ninput used to generate a web page. An authenticated attacker could use this\nvulnerability to execute CSS injection attacks. This issue only affected\nUbuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2017-1000015)\n\nIt was discovered that phpMyAdmin incorrectly handled certain input. An\nattacker could use this vulnerability to execute a cross-site scripting (XSS)\nattack via a crafted URL. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2018-7260)\n\nIt was discovered phpMyAdmin incorrectly handled database names. An\nattacker could possibly use this to trigger a cross-site scripting\nattack. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2018-12581)\n\nDaniel Le Gall discovered that phpMyAdmin would expose sensitive\ninformation to unauthorized actors due to an error in its transformation\nfeature. An authenticated attacker could use this vulnerability to leak\nthe contents of a local file. This issue only affected Ubuntu 14.04 ESM\nand Ubuntu 16.04 ESM. (CVE-2018-19968)\n\nIt was discovered that phpMyAdmin incorrectly handled user input. An\nattacker could possibly use this to perform a cross-site scripting attack.\nThis issue only affected Ubuntu 16.04 ESM. (CVE-2018-19970)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted database name. This issue only affected Ubuntu\n16.04 ESM. (CVE-2019-11768)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 16.04 ESM. (CVE-2019-12616)\n\nIt was discovered that phpMyAdmin incorrectly handled some requests. An\nattacker could possibly use this to perform a cross site request forgery\nattack. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-12922)\n\nIt was discovered that phpMyAdmin failed to properly sanitize input. An\nattacker could use this vulnerability to execute an SQL injection attack\nvia a specially crafted username. This issue only affected Ubuntu 16.04 ESM.\n(CVE-2019-6798)\n\nIt was discovered that phpMyAdmin did not properly sanitize certain input.\nAn attacker could use this vulnerability to possibly execute an HTML injection\nor a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04\nESM and Ubuntu 16.04 ESM. (CVE-2019-19617)\n\nCSW Research Labs discovered that phpMyAdmin failed to properly sanitize\ninput.  An attacker could use this vulnerability to execute SQL injection\nattacks. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-5504)\n\nGiwan Go and Yelang Lee discovered that phpMyAdmin was vulnerable to an\nXSS attack in the transformation feature. If a victim were to click on a\ncrafted link, an attacker could run malicious JavaScript on the victim's\nsystem. This issue only affected Ubuntu 20.04 ESM. (CVE-2020-26934)\n\nAndre Sá discovered that phpMyAdmin incorrectly handled certain SQL\nstatements in the search feature. A remote, authenticated attacker could\nuse this to inject malicious SQL into a query. This issue only affected\nUbuntu 20.04 ESM. (CVE-2020-26935)\n","status":"published","published":"2021-03-16T14:27:57Z","modified":"2026-06-29T13:48:33.558315723Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}