CVE-2017-1000499 - phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness

Back Back to CVE browser

HIGH

phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness

Published Jan 3, 2018

8.8

HIGH

CVSS 3.0

EPSS 8.46%

Description

phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (7)

http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/
x_refsource_MISCExploitPatchThird Party Advisory
http://www.securitytracker.com/id/1040163
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-f9hx-5jq4-fgjm
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-1000499
https://web.archive.org/web/20201208204518/http://www.securitytracker.com/id/1040163
https://www.exploit-db.com/exploits/45284/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.phpmyadmin.net/security/PMASA-2017-9/
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/		x_refsource_MISCExploitPatchThird Party Advisory
http://www.securitytracker.com/id/1040163		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-f9hx-5jq4-fgjm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-1000499
https://web.archive.org/web/20201208204518/http://www.securitytracker.com/id/1040163
https://www.exploit-db.com/exploits/45284/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.phpmyadmin.net/security/PMASA-2017-9/		x_refsource_CONFIRMPatchVendor Advisory