CSRF Vulnerability in phpMyAdmin: Arbitrary SQL Execution Risk
Summary
CVE-2018-10188: phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php. Affects phpmyadmin across 2 version ranges.
< 4:4.9.1+dfsg1-2
< 9d6ac04ae8cd7064c28c93a6a949cb5324899593
Fixed in 4:4.9.1+dfsg1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It provides a user-friendly way to interact with databases, allowing users to perform operations such as creating, modifying, and deleting databases and tables. The tool is essential for developers and database administrators, but it has been found to be vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can lead to unauthorized execution of SQL statements.
Vulnerability Detail
The vulnerability, identified as CVE-2018-10188, exists in phpMyAdmin versions prior to 4.8.0-1. It allows attackers to exploit CSRF weaknesses, enabling them to execute arbitrary SQL statements without the user's consent. This vulnerability arises from insufficient validation of requests, particularly in the files js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php. If exploited, it can lead to severe data breaches, unauthorized data manipulation, and potential loss of sensitive information.
How To Fix
Minimum fixed version
4:4.9.1+dfsg1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement CSRF tokens in their forms to ensure that requests are legitimate. This involves modifying the phpMyAdmin configuration to include CSRF protection mechanisms, although upgrading is the recommended solution.
Conclusion
The CSRF vulnerability in phpMyAdmin (CVE-2018-10188) poses a significant risk to users, allowing unauthorized SQL execution. It is crucial for users to upgrade to the latest version to mitigate this risk and protect their data integrity.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2018-10188 is a vulnerability in phpMyAdmin that allows attackers to execute arbitrary SQL statements through CSRF attacks.
You can check if your phpMyAdmin installation is affected by using the Vulert playground at Vulert Scanner, which requires no signup.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and potential data loss.
Yes, upgrading to phpMyAdmin version 4.9.1+dfsg1-2 or later will patch this vulnerability.
The CVSS score for CVE-2018-10188 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
