Skip to content
OpenAdvisories
Unscored Public exploit CVE-2008-5621 EUVD-2008-5595GHSA-427m-jx2h-q45m

Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perf…

Published Dec 17, 2008 · Updated Aug 7, 2024 · Assigned by mitre

Package: phpmyadmin Ecosystem: Debian

Description

Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 phpmyadmin 4:2.11.8.1-5 —
Debian 13 phpmyadmin 4:2.11.8.1-5 —
Debian 12 phpmyadmin 4:2.11.8.1-5 —
Debian 4.0 phpmyadmin 4:2.9.1.1-10 DSA-1723-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References