PT-2019-12893 · Phpmyadmin+4 · Phpmyadmin+4

Mauro Tempesta · Published 2019-06-05 · Updated 2024-06-15 · CVE-2019-12616

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.9.0

Description A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.

Recommendations For versions prior to 4.9.0, update to version 4.9.0 or later to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures to minimize the risk of exploitation. Restrict access to the phpMyAdmin database to minimize the risk of an attacker delivering a malicious payload.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2019-2041

ALT-PU-2020-3212

ALT-PU-2021-3657

CVE-2019-12616

DLA-1821-1

GHSA-MFR9-PCM3-6MWC

MGASA-2019-0200

OPENSUSE-SU-2019:1689-1

OPENSUSE-SU-2019:1861-1

OPENSUSE-SU-2019_1689-1

OPENSUSE-SU-2024:11171-1

USN-4639-1

USN-4843-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

References · 161

• 🔥 https://exploit-db.com/exploits/46982 · Exploit
• https://ubuntu.com/security/CVE-2014-9218 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4843-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6609 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-3657 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0200.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6624 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10803 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mfr9-pcm3-6mwc · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12616 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26934 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6606 · Security Note