LiveActive security incident?Get immediate response
CVE Record

CVE-2016-9864: An issue was discovered in phpMyAdmin.

An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This vulnerability affects older phpMyAdmin releases. A specially crafted username or table name could make phpMyAdmin run unintended SQL through its tracking feature, using the control user’s database privileges. Business risk depends on whether vulnerable phpMyAdmin is deployed, reachable, and configured with a privileged control user.

Executive priority

Prioritize remediation where phpMyAdmin is internet-facing, shared across teams, or connected with broad control user privileges. For isolated, already-updated, or non-deployed phpMyAdmin, urgency is lower. Treat unknown inventory as the main business risk.

Technical view

CVE-2016-9864 is SQL injection in phpMyAdmin tracking functionality. A crafted username or table name could execute SQL as the phpMyAdmin control user, allowing read/write access to configuration storage tables and possible read access to MySQL tables if the control user permits it. Affected branches are 4.6.x before 4.6.5, 4.4.x before 4.4.15.9, and 4.0.x before 4.0.10.18.

Likely exposure

Exposure is likely limited to environments running the listed legacy phpMyAdmin versions with tracking/configuration storage enabled. Internet-reachable admin interfaces, shared hosting panels, and stale server images are higher concern. The supplied sources do not identify affected downstream package versions beyond referenced vendor advisories.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is still important because SQL injection in an administrative database tool can affect stored configuration data and possibly MySQL metadata, depending on control user privileges.

Researcher notes

The strongest facts come from the CVE description and phpMyAdmin advisory references. No CVSS, CWE, exploit status, or detailed preconditions are provided in the bundle. Validate version exposure and control user permissions rather than assuming compromise.

Mitigation direction

  • Upgrade phpMyAdmin to 4.6.5, 4.4.15.9, 4.0.10.18, or later supported releases.
  • Apply relevant distribution updates from Gentoo, Debian LTS, or your package vendor.
  • Restrict phpMyAdmin access to trusted networks or authenticated administrative paths.
  • Review phpMyAdmin control user privileges and remove unnecessary database access.
  • Check phpMyAdmin vendor guidance before relying on temporary workarounds.

Validation and detection

  • Inventory all phpMyAdmin instances and record exact versions.
  • Confirm no instance runs affected 4.6.x, 4.4.x, or 4.0.x releases.
  • Verify package versions include vendor backports where distribution packages are used.
  • Review phpMyAdmin configuration storage and control user privilege scope.
  • Check database and web logs for unusual tracking-related errors or access patterns.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2016-9864 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.