PT-2020-9136 · Unknown · Phppgadmin

Published 2020-02-04 · Updated 2022-07-25 · CVE-2019-10784

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phppgadmin versions prior to 7.12.1

Description The issue allows sensitive actions to be performed without validating the request origin, which can be exploited by a remote attacker to trick a logged-in administrator into visiting a malicious page. This can lead to the execution of arbitrary system commands on the server. The "database.php" area does not verify the source of an HTTP request, making it vulnerable to CSRF exploits.

Recommendations For versions prior to 7.12.1, update to version 7.12.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "database.php" page to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-10784

MGASA-2021-0074

OPENSUSE-SU-2022:10065-1

OPENSUSE-SU-2024:12194-1

SNYK-PHP-PHPPGADMINPHPPGADMIN-543885

Affected Products

Phppgadmin

References · 15

• 🔥 https://snyk.io/vuln/SNYK-PHP-PHPPGADMINPHPPGADMIN-543885 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2019-10784 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0074.html · Security Note
• https://osv.dev/vulnerability/CVE-2019-10784 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0074 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10784 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10065-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10784 · Security Note
• https://ubuntu.com/security/CVE-2019-10784 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10784 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10784 · Security Note
• https://suse.com/security/cve/CVE-2019-10784 · Note
• https://bugs.mageia.org/show_bug.cgi?id=27912 · Note
• https://bugzilla.suse.com/1162794 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/4YEBNCIRQOKETS4R7J5GXRP3TKF2YKFJ · Note