phpMyAdmin Cross-Site Request Forgery Vulnerability
A vulnerability in phpMyAdmin could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on a targeted system.
The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by convincing a user to click a malicious link. A successful exploit could allow the attacker to perform unauthorized database operations such as deleting records or dropping tables.
Proof-of-concept code that demonstrates an exploit of this vulnerability is publicly available.
phpMyAdmin has confirmed the vulnerability and released software updates.
CVE Number = CVE-2017-1000499
-
To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and uses misleading language or instructions to persuade the user to follow the provided link.
-
Administrators are advised to apply the appropriate updates.
Users should verify that unsolicited links are safe to follow.
For additional information about cross-site request forgery attacks and potential mitigation methods, see the Cisco Applied Mitigation Bulletin Understanding Cross-Site Request Forgery Threat Vectors.
Administrators can apply Snort SID 45406 to help prevent attacks that attempt to exploit this vulnerability.
Administrators are advised to monitor affected systems.
Affected Products
phpMyAdmin Project – 4.7 (.0, .1, .2, .3, .4, .5, .6)
-
phpMyAdmin released a security advisory at the following link: PMASA-2017-9
-
phpMyAdmin has released software updates at the following link: phpMyAdmin 4.7.7
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.