Warning: Researcher Drops phpMyAdmin Zero-Day Affecting All Versions

A cybersecurity researcher recently published details and proof-of-concept for an unpatched zero-day vulnerability in phpMyAdmin—one of the most popular applications for managing the MySQL and MariaDB databases.

phpMyAdmin is a free and open source administration tool for MySQL and MariaDB that’s widely used to manage the database for websites created with WordPress, Joomla, and many other content management platforms.

Discovered by security researcher and pentester Manuel Garcia Cardenas, the vulnerability claims to be a cross-site request forgery (CSRF) flaw, also known as XSRF, a well-known attack wherein attackers trick authenticated users into executing an unwanted action.

Identified as CVE-2019-12922, the flaw has been given a medium rating because of its limited scope that only allows an attacker to delete any server configured in the setup page of a phpMyAdmin panel on a victim’s server.

To be noted, it’s not something you should not be much worried about because the attack doesn’t allow attackers to delete any database or table stored on the server.

All an attacker needs to do is send a crafted URL to targeted web administrators, who already have logged in to their phpmyAdmin panel on the same browser, tricking them into unknowingly delete the configured server by simply clicking on it.

> “The attacker can easily create a fake hyperlink containing the request that wants to execute on behalf of the user, in this way making possible a CSRF attack due to the wrong use of HTTP method,” Cardenas explains in a post to the Full Disclosure mailing list.

However, the vulnerability is trivial to exploit because other than knowing the URL of a targeted server, an attacker doesn’t need to know any other information, like the name of the databases.

Proof of Concept Exploit Code

The flaw affects phpMyAdmin versions up to and including 4.9.0.1, which is the latest version of the software at the time of writing.

The security flaw also resides in phpMyAdmin 5.0.0-alpha1, which was released in July 2019, Cardenas told The Hacker News.

Cardenas discovered this vulnerability back in June 2019, and also responsibly reported it to the project maintainers.

However, after phpMyAdmin maintainers failed to patch the vulnerability within 90 days of being notified, the researcher decided to release the vulnerability details and PoC to the public on 13 September.

To address this vulnerability, Cardenas recommended to “implement in each call the validation of the token variable, as already done in other phpMyAdmin requests,” as a solution.

Until the maintainers patch the vulnerability, website administrators and hosting providers are highly recommended to avoid clicking any suspicious links.