PT-2006-5854 · Php · Phpmyadmin

Stefan Esser · Published 2006-10-02 · Updated 2018-10-17 · CVE-2006-5116

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 2.9.1-rc1

Description The issue allows remote attackers to perform unauthorized actions as another user due to multiple cross-site request forgery (CSRF) vulnerabilities. This is related to the direct setting of a token in the URL through dynamic variable evaluation and unsetting arbitrary variables via the REQUEST array. The affected files include libraries/common.lib.php, session.inc.php, and url generating.lib.php.

Recommendations For versions prior to 2.9.1-rc1, update to version 2.9.1-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions and variables to minimize the risk of exploitation. Avoid using the REQUEST array to unset arbitrary variables in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2006-5116

DSA-1207-1

Affected Products

Phpmyadmin

References · 18

• https://osv.dev/vulnerability/CVE-2006-5116 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-5116 · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html · Vendor Advisory
• http://securityfocus.com/bid/20253 · Patch
• http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5116 · Vendor Advisory
• http://debian.org/security/2006/dsa-1207 · Vendor Advisory
• http://secunia.com/advisories/22126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5116 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5116 · Note
• http://attrition.org/pipermail/vim/2006-October/001067.html · Note
• http://phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5 · Note
• http://hardened-php.net/advisory_072006.130.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29301 · Note
• http://secunia.com/advisories/23086 · Note