phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution in phpmyadmin/phpmyadmin
Summary
CVE-2018-10188: phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution. Affects phpmyadmin/phpmyadmin versions >= 4.8, < 4.8.0.1. Fixed in 4.8.0.1. How to fix ↓
Also tracked for
- phpmyadmin · Debian:11
The same CVE-2018-10188 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a popular web-based administration tool for managing MySQL and MariaDB databases. It provides a user-friendly interface for performing various database operations such as creating tables, executing SQL queries, and managing user privileges. However, a vulnerability has been discovered in phpMyAdmin versions 4.8.0 before 4.8.0-1 that allows an attacker to execute arbitrary SQL statements. This vulnerability is due to a Cross-Site Request Forgery (CSRF) issue in several JavaScript and PHP files used by phpMyAdmin.
Vulnerability Detail
The CSRF vulnerability in phpMyAdmin allows an attacker to trick a logged-in user into unknowingly executing arbitrary SQL statements. By crafting a malicious request and tricking the user into visiting a specially crafted webpage or clicking on a malicious link, the attacker can perform unauthorized actions on the database. This can lead to data manipulation, unauthorized access, and potential data breaches. The vulnerability is present in the following files: js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
How To Fix
Minimum fixed version
4.8.0.1
This is the first release that contains the fix.
composer require phpmyadmin/phpmyadmin:4.8.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by disabling the affected JavaScript files. This can be done by modifying the phpMyAdmin configuration to exclude the following files: js/db_operations.js and js/tbl_operations.js. However, this workaround may limit the functionality of phpMyAdmin and is not a permanent solution. Upgrading to the latest version is strongly recommended.
Conclusion
The CSRF vulnerability in phpMyAdmin versions 4.8.0 before 4.8.0-1 can allow an attacker to execute arbitrary SQL statements, potentially leading to unauthorized data manipulation and data breaches. It is crucial to upgrade phpMyAdmin to version 4.8.0.1 or later to mitigate the risk of exploitation. If immediate upgrading is not possible, users can implement a temporary workaround by disabling the affected JavaScript files, but upgrading to the latest version is strongly recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpmyadmin/phpmyadmin →
FAQ
phpMyAdmin is a web-based administration tool for managing MySQL and MariaDB databases. It provides a graphical interface for performing various database operations.
A CSRF vulnerability allows an attacker to perform unauthorized actions on behalf of a logged-in user by tricking them into unknowingly executing malicious requests.
An attacker can exploit this vulnerability by crafting a malicious request and tricking a logged-in user into visiting a specially crafted webpage or clicking on a malicious link.
This vulnerability can lead to unauthorized data manipulation, unauthorized access to the database, and potential data breaches.
To fix this vulnerability, it is recommended to upgrade phpMyAdmin to version 4.8.0.1 or later. This will address the CSRF issue and prevent unauthorized SQL execution.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin/phpmyadmin.
