phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
References
| Link | Resource |
|---|---|
| http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ | Exploit Patch Third Party Advisory |
| http://www.securitytracker.com/id/1040163 | Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/45284/ | Exploit Third Party Advisory VDB Entry |
| https://www.phpmyadmin.net/security/PMASA-2017-9/ | Patch Vendor Advisory |
| http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ | Exploit Patch Third Party Advisory |
| http://www.securitytracker.com/id/1040163 | Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/45284/ | Exploit Third Party Advisory VDB Entry |
| https://www.phpmyadmin.net/security/PMASA-2017-9/ | Patch Vendor Advisory |
Configurations
History
21 Nov 2024, 03:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ - Exploit, Patch, Third Party Advisory | |
| References | () http://www.securitytracker.com/id/1040163 - Third Party Advisory, VDB Entry | |
| References | () https://www.exploit-db.com/exploits/45284/ - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.phpmyadmin.net/security/PMASA-2017-9/ - Patch, Vendor Advisory |
Information
Published : 2018-01-03 14:29
Updated : 2024-11-21 03:04
NVD link : CVE-2017-1000499
Mitre link : CVE-2017-1000499
CVE.ORG link : CVE-2017-1000499
JSON object : View
Products Affected
phpmyadmin
- phpmyadmin
CWE
CWE-352
Cross-Site Request Forgery (CSRF)