Description
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:4.6.3-1 | — |
| Debian 13 | phpmyadmin | 4:4.6.3-1 | — |
| Debian 12 | phpmyadmin | 4:4.6.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | phpmyadmin | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | phpMyAdmin | 4.6.5.2-1.1 | openSUSE-SU-2024:10054-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
phpMyAdmin Authenticated Remote Code Execution
exploit/multi/http/phpmyadmin_null_termination_exec
Exploit-DB 1
- phpMyAdmin 4.6.2 - (Authenticated) Remote Code Execution EDB-40185 · webapps · Jul 29, 2016
GitHub 3 repositories
-
miko550/CVE-2016-5734-docker ★ 1 · Sep 10, 2022
PhpMyAdmin 4.0.x—4.6.2 Remote Code Execution Vulnerability (CVE-2016-5734)
-
HKirito/phpmyadmin4.4_cve-2016-5734 ★ 0 · May 22, 2020
-
KosukeShimofuji/CVE-2016-5734 ★ 0 · Jul 8, 2016
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | >= 4.0.10.0, < 4.0.10.16 | 4.0.10.16 | GHSA-rv57-479x-x4qv |
| Packagist | phpmyadmin/phpmyadmin | >= 4.4.15.0, < 4.4.15.7 | 4.4.15.7 | GHSA-rv57-479x-x4qv |
| Packagist | phpmyadmin/phpmyadmin | >= 4.6.0, < 4.6.3 | 4.6.3 | GHSA-rv57-479x-x4qv |
Advisories 1
- openSUSE-SU-2024:10054-1 phpMyAdmin-4.6.5.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026