Description
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
phpMyAdmin phpMyAdmin
Default version status: unaffected
0 to ≤ 5.2.3affected
pkg:composer/phpmyadmin/phpmyadminReferences
- https://github.com/phpmyadmin/phpmyadmin/commit/d1e2b54b530685c24dd91181b9f64a5a64621789 ↗
- https://github.com/phpmyadmin/phpmyadmin/commit/910322373f14ed4601c85234858f630f127569ef ↗
- https://github.com/phpmyadmin/phpmyadmin/pull/20569 ↗
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Common.php#L87-L151 ↗
- https://abraxaslabs.tech/research/phpmyadmin-csrf-sql ↗
- https://github.com/phpmyadmin/phpmyadmin ↗
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-csrf-token-bypass-via-non-ajax-post-to-sql ↗