Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-10188 — Cross-Site Request Forgery in Phpmyadmin

CWE-352 — Cross-Site Request Forgery6 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.9%
top 23.82%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedApr 19
Latest updateMay 14

Description

phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:4.9.1+dfsg1-2 (bookworm)
▶Packagistphpmyadmin/phpmyadmin4.8 — 4.8.0.1
▶Debianphpmyadmin/phpmyadmin< 4:4.9.1+dfsg1-2+3

🔴Vulnerability Details

3
OSV
phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution↗2022-05-14
▶
GHSA
phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution↗2022-05-14
▶
OSV
CVE-2018-10188: phpMyAdmin 4↗2018-04-19
▶

💥Exploits & PoCs

1
Exploit-DB
phpMyAdmin 4.8.0 < 4.8.0-1 - Cross-Site Request Forgery↗2018-04-23
▶

📋Vendor Advisories

1
Debian
CVE-2018-10188: phpmyadmin - phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitr...↗2018
▶