PT-2026-21320 · Unknown · Phpmoadmin

Ozer Goker · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2019-25451

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPMoAdmin version 1.1.5

Description The software contains a cross-site request forgery flaw. This allows attackers to perform unauthorized database operations by creating malicious requests. Attackers can deceive authenticated users into submitting GET requests to the moadmin.php endpoint with parameters such as action, db, and collection. This enables the creation, deletion, or repair of databases and collections without the user's knowledge. The vulnerable parameter is action.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the moadmin.php endpoint to minimize the risk of exploitation.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2019-25451

Produtos afetados

Phpmoadmin

Referências · 5

• 🔥 https://exploit-db.com/exploits/46082 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25451 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-25451 · Aviso do Fabricante
• https://vulncheck.com/advisories/phpmoadmin-cross-site-request-forgery-via-moadminphp · Nota
• http://phpmoadmin.com · Nota