PT-2008-4614 · Phpmyadmin · Phpmyadmin

Publicado

2008-07-16

·

Atualizado

2017-08-08

·

CVE-2008-3197

CVSS v2.0

3.5

Baixa

VetorAV:N/AC:M/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions prior to 2.11.7.1
Description: A cross-site request forgery (CSRF) issue allows remote attackers to perform unauthorized actions. This is achieved via a link or IMG tag to specific parameters, including the db parameter in the "Creating a Database" functionality, and the convcharset and collation connection parameters related to modifying the connection character set. The affected API endpoints include db create.php.
Recommendations: For versions prior to 2.11.7.1, update to version 2.11.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the db create.php endpoint and avoiding the use of the convcharset and collation connection parameters until the issue is resolved.

Exploit

Correção

CSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-3197
DSA-1641-1

Produtos afetados

Phpmyadmin