PT-2008-4614 · Phpmyadmin · Phpmyadmin

Published 2008-07-16 · Updated 2017-08-08 · CVE-2008-3197

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: phpMyAdmin versions prior to 2.11.7.1

Description: A cross-site request forgery (CSRF) issue allows remote attackers to perform unauthorized actions. This is achieved via a link or IMG tag to specific parameters, including the db parameter in the "Creating a Database" functionality, and the convcharset and collation connection parameters related to modifying the connection character set. The affected API endpoints include db create.php.

Recommendations: For versions prior to 2.11.7.1, update to version 2.11.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the db create.php endpoint and avoiding the use of the convcharset and collation connection parameters until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-3197

DSA-1641-1

Affected Products

Phpmyadmin

References · 21

• 🔥 http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf · Exploit
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00590.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00652.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:202 · Vendor Advisory
• http://debian.org/security/2008/dsa-1641 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3197 · Vendor Advisory
• http://secunia.com/advisories/31115 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-3197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3197 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3197 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2116/references · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3197 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43846 · Note
• http://openwall.com/lists/oss-security/2008/07/15/6 · Note