CVE-2008-1149 — SQL Injection in Phpmyadmin

CWE-89 — SQL InjectionCWE-352 — Cross-Site Request Forgery7 documents7 sources
Severity
5.1MEDIUMNVD
EPSS
0.9%
top 24.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedMar 4
Latest updateMay 1

Description

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:2.11.5-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:2.11.5-1+3
▶NVDphpmyadmin/phpmyadmin2.11.4+13

Patches

Patch: www.debian.org ↗Patch: www.phpmyadmin.net ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p842-vv7g-4q9v: phpMyAdmin before 2↗2022-05-01
▶
OSV
CVE-2008-1149: phpMyAdmin before 2↗2008-03-04
▶

💥Exploits & PoCs

1
Exploit-DB
Pixel8 Web Photo Album 3.0 - SQL Injection↗2008-12-30
▶

📋Vendor Advisories

2
Red Hat
phpMyAdmin 2.11.5 contains a security fix↗2008-03-01
▶
Debian
CVE-2008-1149: phpmyadmin - phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-1149 phpMyAdmin 2.11.5 contains a security fix↗2008-03-03
▶