CVE-2019-12616

🗓️ 05 Jun 2019 04:27:12Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 533 Views🌐 WEB

An issue in phpMyAdmin before 4.9.0 allows CSRF attack via image tag

Reporter	Title	Published	Views	Family All 58
0day.today	phpMyAdmin 4.8 - Cross-Site Request Forgery Vulnerability	11 Jun 201900:00	–	zdt
FreeBSD	phpMyAdmin -- CSRF vulnerability in login form	4 Jun 201900:00	–	freebsd
AlpineLinux	CVE-2019-12616	5 Jun 201904:27	–	alpinelinux
Check Point Advisories	phpMyAdmin Cross-Site Request Forgery (CVE-2019-12616)	19 Jun 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-12616	5 Jun 201904:27	–	cvelist
Debian	[SECURITY] [DLA 1821-1] phpmyadmin security update	17 Jun 201920:41	–	debian
Debian CVE	CVE-2019-12616	5 Jun 201904:27	–	debiancve
Tenable Nessus	Debian DLA-1821-1 : phpmyadmin security update	18 Jun 201900:00	–	nessus
Tenable Nessus	Fedora 30 : php-phpmyadmin-sql-parser / phpMyAdmin (2019-13d2ba0aed)	14 Jun 201900:00	–	nessus
Tenable Nessus	Fedora 29 : php-phpmyadmin-sql-parser / phpMyAdmin (2019-33649e2e64)	14 Jun 201900:00	–	nessus

NVD

Node

phpmyadmin phpmyadminRange<4.9.0

Source	Link
phpmyadmin	www.phpmyadmin.net/security/
phpmyadmin	www.phpmyadmin.net/security/PMASA-2019-4/
securityfocus	www.securityfocus.com/bid/108619
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/
lists	www.lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html
lists	www.lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html
lists	www.lists.debian.org/debian-lts-announce/2019/06/msg00009.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/
packetstormsecurity	www.packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html

Parameter	Position	Path	Description	CWE
sql_query	query param	tbl_sql.php?sql_query=INSERT+INTO+%60pma__bookmark%60+(%60id%60%2C+%60dbase%60%2C+%60user%60%2C+%60label%60%2C+%60query%60)+VALUES+(DAYOFWEEK(%27%27)%2C+%27%27%2C+%27%27%2C+%27%27%2C+%27%27)&show_query=1&db=phpmyadmin&table=pma__bookmark	CSRF attack vector via a crafted GET request to tbl_sql.php that executes SQL when the victim is authenticated	CWE-352
show_query	query param	tbl_sql.php?sql_query=INSERT+INTO+%60pma__bookmark%60+(%60id%60%2C+%60dbase%60%2C+%60user%60%2C+%60label%60%2C+%60query%60)+VALUES+(DAYOFWEEK(%27%27)%2C+%27%27%2C+%27%27%2C+%27%27%2C+%27%27)&show_query=1&db=phpmyadmin&table=pma__bookmark	CSRF attack vector via a crafted GET request to tbl_sql.php that executes SQL when the victim is authenticated	CWE-352
db	query param	tbl_sql.php?sql_query=INSERT+INTO+%60pma__bookmark%60+(%60id%60%2C+%60dbase%60%2C+%60user%60%2C+%60label%60%2C+%60query%60)+VALUES+(DAYOFWEEK(%27%27)%2C+%27%27%2C+%27%27%2C+%27%27%2C+%27%27)&show_query=1&db=phpmyadmin&table=pma__bookmark	CSRF attack vector via a crafted GET request to tbl_sql.php that executes SQL when the victim is authenticated	CWE-352
table	query param	tbl_sql.php?sql_query=INSERT+INTO+%60pma__bookmark%60+(%60id%60%2C+%60dbase%60%2C+%60user%60%2C+%60label%60%2C+%60query%60)+VALUES+(DAYOFWEEK(%27%27)%2C+%27%27%2C+%27%27%2C+%27%27%2C+%27%27)&show_query=1&db=phpmyadmin&table=pma__bookmark	CSRF attack vector via a crafted GET request to tbl_sql.php that executes SQL when the victim is authenticated	CWE-352

21 Nov 2024 04:23Current

7.5High risk

Vulners AI Score7.5

CVSS 24.3

CVSS 36.5

EPSS0.52136

CWE-352