CVE-2016-9864

CVE-2016-9864 describes a SQL injection vulnerability in phpMyAdmin versions prior to 4.6.5, 4.4.15.9, and 4.0.10.18. An attacker can craft a malicious username or table name to inject SQL statements into the tracking functionality, which then execute with the privileges of the control user. This allows for high impact read and write access to the configuration storage database and potentially read access to some MySQL database tables, earning a CVSS score of 7.5 (High) due to its network attack vector, low privileges required, and high confidentiality, integrity, and availability impact. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.