CVE-2008-5621

Published: Dec 17, 2008Modified: Apr 23, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.

Affected (27)

Products: Phpmyadmin: Phpmyadmin

1 product

Configuration A

27 vulnerable

Vulnerable Software	Affected Versions
Phpmyadmin Phpmyadmin	Version 2.11.0.0
Phpmyadmin Phpmyadmin	Version 2.11.0
Phpmyadmin Phpmyadmin	Version 2.11.1.0
Phpmyadmin Phpmyadmin	Version 2.11.1.1
Phpmyadmin Phpmyadmin	Version 2.11.1.2
Phpmyadmin Phpmyadmin	Version 2.11.1
Phpmyadmin Phpmyadmin	Version 2.11.2.0
Phpmyadmin Phpmyadmin	Version 2.11.2.1
Phpmyadmin Phpmyadmin	Version 2.11.2.2
Phpmyadmin Phpmyadmin	Version 2.11.2
Phpmyadmin Phpmyadmin	Version 2.11.3.0
Phpmyadmin Phpmyadmin	Version 2.11.3
Phpmyadmin Phpmyadmin	Version 2.11.4.0
Phpmyadmin Phpmyadmin	Version 2.11.5.0
Phpmyadmin Phpmyadmin	Version 2.11.5.1
Phpmyadmin Phpmyadmin	Version 2.11.5.2
Phpmyadmin Phpmyadmin	Version 2.11.6.0
Phpmyadmin Phpmyadmin	Version 2.11.7.0
Phpmyadmin Phpmyadmin	Version 2.11.7
Phpmyadmin Phpmyadmin	Version 2.11.8
Phpmyadmin Phpmyadmin	Version 2.11.9.0
Phpmyadmin Phpmyadmin	Version 2.11.9.1
Phpmyadmin Phpmyadmin	Version 2.11.9.2
Phpmyadmin Phpmyadmin	Version 2.11.9.3
Phpmyadmin Phpmyadmin	Version 3.0.0
Phpmyadmin Phpmyadmin	Version 3.0.1
Phpmyadmin Phpmyadmin	Version 3.1.0.0

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (38)

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html

Source: cve@mitre.org

http://osvdb.org/50894

Source: cve@mitre.org

http://secunia.com/advisories/33076

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/33146

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/33246

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/33822

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/33912

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200903-32.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/4753

Source: cve@mitre.org

http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1723

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/02/12/1

Source: cve@mitre.org

http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php

Source: cve@mitre.org

PatchVendor Advisory

http://www.securityfocus.com/bid/32720

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2008/3402

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/3501

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/47168

Source: cve@mitre.org

https://www.exploit-db.com/exploits/7382

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/50894

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33076

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33146

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33246

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33822

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33912

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200903-32.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/4753

Source: af854a3a-2127-422b-91ae-364da2661108

http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1723

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/02/12/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/32720

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vupen.com/english/advisories/2008/3402

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2008/3501

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/47168

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/7382

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.