Vulnerabilities > CVE-2016-4412 - 7PK - Security Features vulnerability in PHPmyadmin
Attack vector
NETWORK Attack complexity
HIGH Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Summary
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2016-6576A8536B.NASL description phpMyAdmin 4.6.5.1 (2016-11-26) =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg[ last seen 2020-06-05 modified 2016-12-05 plugin id 95490 published 2016-12-05 reporter This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/95490 title Fedora 25 : phpMyAdmin (2016-6576a8536b) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-757.NASL description Various security issues where found and fixed in phpmyadmin in wheezy. CVE-2016-4412 / PMASA-2016-57 A user can be tricked in following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. CVE-2016-6626 / PMASA-2016-49 In the fix for PMASA-2016-57, we didn last seen 2020-03-17 modified 2016-12-27 plugin id 96093 published 2016-12-27 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/96093 title Debian DLA-757-1 : phpmyadmin security update NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_6FE72178B2E311E68B2A6805CA0B3D42.NASL description Please reference CVE/URL list for details last seen 2020-06-01 modified 2020-06-02 plugin id 95364 published 2016-11-28 reporter This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/95364 title FreeBSD : phpMyAdmin -- multiple vulnerabilities (6fe72178-b2e3-11e6-8b2a-6805ca0b3d42) NASL family Fedora Local Security Checks NASL id FEDORA_2016-7FC142DA66.NASL description phpMyAdmin 4.6.5.1 (2016-11-26) =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg[ last seen 2020-06-05 modified 2016-12-08 plugin id 95613 published 2016-12-08 reporter This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/95613 title Fedora 23 : phpMyAdmin (2016-7fc142da66) NASL family Fedora Local Security Checks NASL id FEDORA_2016-2424EECA35.NASL description phpMyAdmin 4.6.5.1 (2016-11-26) =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg[ last seen 2020-06-05 modified 2016-12-12 plugin id 95670 published 2016-12-12 reporter This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/95670 title Fedora 24 : phpMyAdmin (2016-2424eeca35) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201701-32.NASL description The remote host is affected by the vulnerability described in GLSA-201701-32 (phpMyAdmin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in phpMyAdmin. Please review the CVE identifiers referenced below for details. Impact : A authenticated remote attacker could exploit these vulnerabilities to execute arbitrary PHP Code, inject SQL code, or to conduct Cross-Site Scripting attacks. In certain configurations, an unauthenticated remote attacker could cause a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 96426 published 2017-01-12 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/96426 title GLSA-201701-32 : phpMyAdmin: Multiple vulnerabilities