CVE-2016-9849

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Dec 11, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-98505.3An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username CVE-2016-98515.3An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versionCVE-2016-98525.3An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger pCVE-2016-98535.3An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger pCVE-2016-98545.3An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger pCVE-2016-98555.3An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger pCVE-2016-98566.1An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a cCVE-2016-98576.1An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. AllCVE-2016-98585.3An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in savedCVE-2016-98595.3An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in imporCVE-2016-98605.9An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['CVE-2016-98617.5An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4
CVE-2016-9849: Critical severity, CVSS 9.8 | Vulnix