Description
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html ↗
- http://www.vupen.com/english/advisories/2008/3501 ↗
- http://security.gentoo.org/glsa/glsa-200903-32.xml ↗
- http://www.debian.org/security/2009/dsa-1723 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47168 ↗
- http://securityreason.com/securityalert/4753 ↗
- http://www.vupen.com/english/advisories/2008/3402 ↗
- http://osvdb.org/50894 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html ↗
- http://secunia.com/advisories/33146 ↗
- http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php ↗
- http://secunia.com/advisories/33822 ↗
- http://secunia.com/advisories/33246 ↗
- http://www.openwall.com/lists/oss-security/2009/02/12/1 ↗
- http://www.securityfocus.com/bid/32720 ↗
- http://secunia.com/advisories/33912 ↗
- https://www.exploit-db.com/exploits/7382 ↗
- http://secunia.com/advisories/33076 ↗
- http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/ ↗