CVE-2006-5116 — Phpmyadmin vulnerability

4 documents4 sources
Severity
5.1MEDIUMNVD
OSV9.3
EPSS
3.9%
top 11.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedOct 3
Latest updateMay 1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:2.9.0.2-0.1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:2.9.0.2-0.1+3
▶NVDphpmyadmin/phpmyadmin8 versions+7

Patches

Patch: prdownloads.sourceforge.net ↗Patch: www.securityfocus.com ↗Patch: prdownloads.sourceforge.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-782v-4ghj-5xm3: Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2↗2022-05-01
▶
OSV
CVE-2006-5116: Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2↗2006-10-03
▶

📋Vendor Advisories

1
Debian
CVE-2006-5116: phpmyadmin - Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before ...↗2006
▶