Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2008-5621 — Cross-Site Request Forgery in Phpmyadmin

CWE-352 — Cross-Site Request Forgery6 documents6 sources
Severity
6.0MEDIUMNVD
EPSS
0.6%
top 29.16%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedDec 17
Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 6.8 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:2.11.8.1-5 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:2.11.8.1-5+3
▶NVDphpmyadmin/phpmyadmin27 versions+26

Patches

Patch: www.phpmyadmin.net ↗Patch: www.securityfocus.com ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-427m-jx2h-q45m: Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2↗2022-05-17
▶
OSV
CVE-2008-5621: Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2↗2008-12-17
▶

💥Exploits & PoCs

1
Exploit-DB
phpMyAdmin 3.1.0 - Cross-Site Request Forgery / SQL Injection↗2008-12-08
▶

📋Vendor Advisories

2
Debian
CVE-2008-5621: phpmyadmin - Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11...↗2008
▶
Red Hat
phpMyAdmin: SQL injection through XSRF on several pages (PMASA-2008-10)↗
▶