diff --git a/ChangeLog b/ChangeLog
index b5030eacb0..d0d87cd41d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -90,6 +90,7 @@ phpMyAdmin - ChangeLog
 - issue #12691 Remove ksort call on empty array in PMA_getPlugins function
 - issue #12443 Check parameter type before processing
 - issue #12299 Avoid generating too long URLs in search
+- issue #12361 Fix self SQL injection in table-specific privileges
 
 4.6.4 (2016-08-16)
 - issue        [security] Weaknesses with cookie encryption, see PMASA-2016-29
diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
index 17a88edf3a..c328dd492a 100644
--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@@ -187,8 +187,16 @@ function PMA_extractPrivInfo($row = null, $enableHTML = false, $tablePrivs = fal
                 && is_array($GLOBALS[$current_grant[0]])
                 && empty($GLOBALS[$current_grant[0] . '_none'])
             ) {
+                // Required for proper escaping of ` (backtick) in a column name
+                $grant_cols = array_map(
+                    function($val) {
+                        return Util::backquote($val);
+                    },
+                    $GLOBALS[$current_grant[0]]
+                );
+
                 $privs[] = PMA_formatPrivilege($current_grant, $enableHTML)
-                    . ' (`' . join('`, `', $GLOBALS[$current_grant[0]]) . '`)';
+                    . ' (' . join(', ', $grant_cols) . ')';
             } else {
                 $allPrivileges = false;
             }