CVE-2016-5734 PoC — phpMyAdmin 安全漏洞

Source

https://github.com/miko550/CVE-2016-5734-docker

Associated Vulnerability

Title:phpMyAdmin 安全漏洞 (CVE-2016-5734)
Description:phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.

Description

PhpMyAdmin 4.0.x—4.6.2 Remote Code Execution Vulnerability (CVE-2016-5734)

Readme

# CVE-2016-5734-docker
PhpMyAdmin 4.0.x—4.6.2 Remote Code Execution Vulnerability (CVE-2016-5734)

## Setup
```
git clone https://github.com/miko550/CVE-2016-5734-docker.git
cd CVE-2016-5734-docker
docker compose up
hhtp://localhost:8083
```
## exploit
```
python3 cve-2016-5734.py -u root --pwd="root" http://localhost:8083 -c "system('ls -lua')"
```

# Reference
https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2016-5734
https://github.com/allyshka/exploits/tree/master/CVE-2016-5734

File Snapshot


 [4.0K]  /data/pocs/f880658bd6455ffffe753560cf5dc048eabb523d
├── [ 714]  config.inc.php
├── [4.1K]  cve-2016-5734.py
├── [ 285]  docker-compose.yml
└── [ 500]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!