CSRF Vulnerability in phpMyAdmin Allows Server Deletion
Summary
CVE-2019-12922: A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. Affects phpmyadmin across 3 version ranges.
< 4:4.9.1+dfsg1-2
< 7d21d4223bdbe0306593309132b4263d7087d13b
< 427fbed55d3154d96ecfc1c7784d49eaa3c04161
Fixed in 4:4.9.1+dfsg1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely-used open-source tool for managing MySQL databases through a web interface. It provides features such as database creation, modification, and administration, making it essential for developers and database administrators. However, the tool is susceptible to Cross-Site Request Forgery (CSRF) attacks, which can lead to unauthorized actions being performed on behalf of authenticated users.
Vulnerability Detail
The vulnerability identified as CVE-2019-12922 is a CSRF issue present in phpMyAdmin version 4.9.0.1. This flaw allows an attacker to craft a malicious request that, when executed by an authenticated user, can result in the deletion of any server listed on the Setup page. The attack exploits the lack of proper CSRF protection, enabling unauthorized actions without the user's consent. The potential ramifications include loss of critical database configurations and data, leading to significant operational disruptions.
How To Fix
Minimum fixed version
4:4.9.1+dfsg1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement CSRF tokens in their phpMyAdmin setup. This involves modifying the configuration to require a unique token for each request that alters server settings. However, this is not a substitute for upgrading to a secure version.
Conclusion
CVE-2019-12922 represents a significant security risk for phpMyAdmin users, allowing unauthorized server deletions through CSRF attacks. It is crucial for users to upgrade to version 4.9.1 or later to protect their installations. Implementing temporary workarounds can help, but they should not replace the need for an upgrade.
See every vulnerability recorded for phpmyadmin →
FAQ
CVE-2019-12922 is a vulnerability in phpMyAdmin that allows attackers to perform unauthorized actions, such as deleting servers, through CSRF attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to the deletion of critical server configurations, resulting in data loss and operational disruptions.
Yes, implementing CSRF tokens can help mitigate the risk, but it is strongly recommended to upgrade to a secure version.
The CVSS score for CVE-2019-12922 is 6.5, indicating a medium level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
