Description
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:202 ↗
- http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 ↗
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43846 ↗
- http://sourceforge.net/project/shownotes.php?release_id=613660 ↗
- http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5 ↗
- http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf ↗
- http://www.openwall.com/lists/oss-security/2008/07/15/6 ↗
- http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html ↗
- http://www.debian.org/security/2008/dsa-1641 ↗
- http://secunia.com/advisories/33822 ↗
- http://www.vupen.com/english/advisories/2008/2116/references ↗
- http://secunia.com/advisories/31097 ↗
- http://secunia.com/advisories/31115 ↗