CVE-2016-5734: phpMyAdmin preg_replace eval modifier allows PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no privileges or interaction required, public exploit code, and very high EPSS make this an urgent remote code execution risk.

What it is

phpMyAdmin fails to properly choose delimiters that would prevent use of the preg_replace e (eval) modifier, allowing a crafted string to be evaluated as PHP. This affects 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3, and is demonstrated through the table search-and-replace implementation. Because phpMyAdmin is a widely deployed web-facing database tool, successful exploitation can hand an attacker code execution in the web server context.

Impact

An attacker can execute arbitrary PHP code on the host running phpMyAdmin, which typically yields access to database credentials and the underlying server. This can lead to full compromise of the database and the web application.

Attack surface

The flaw is reachable over the network via the phpMyAdmin web interface, specifically through the table search-and-replace functionality. The CVSS vector indicates no privileges and no user interaction are required, so it can be triggered directly by an unauthenticated or minimally authenticated request depending on deployment.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.81373 (99.6th percentile) and a public Exploit-DB entry (40185) exists, indicating mature public exploitation. No ransomware group usage is documented in the record.

What to do

• Upgrade phpMyAdmin to 4.0.10.16, 4.4.15.7, 4.6.3 or later; the vendor advisory PMASA-2016-27 and patch commits are the authoritative fix.
• If immediate upgrade is not possible, restrict network access to phpMyAdmin to trusted management networks or place it behind a VPN.
• Disable or remove unused phpMyAdmin installations and ensure the search-and-replace feature is not exposed to untrusted users.
• Apply the Gentoo GLSA 201701-32 guidance if running the Gentoo package.
• Monitor web server and PHP logs for anomalous preg_replace or eval-related errors following search-and-replace requests.

Detection

• Review phpMyAdmin access logs for requests to the table search-and-replace endpoint with unusual or crafted replacement strings.
• Search PHP error logs for preg_replace/eval warnings or fatal errors correlated with phpMyAdmin requests.
• Hunt for unexpected outbound connections or new processes spawned by the web server user after phpMyAdmin activity.
• Check for modified PHP files or webshells in web-accessible directories on hosts running affected phpMyAdmin versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.