Code Execution Vulnerability in phpMyAdmin Affects Multiple Versions
CVE-2016-6620
9.8CRITICAL
Summary
A security issue has been identified in phpMyAdmin where unsanitized or invalid serialized data can be passed to the PHP unserialize() function. This flaw allows for unauthenticated remote code execution through the manipulation of object instantiation and autoloading processes. All users of phpMyAdmin versions 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17 are urged to update their installations to mitigate potential exploitation. Proper validation of serialized data is essential to ensure the integrity and security of the application.
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved