Researcher Drops phpMyAdmin Zero-Day

guest · Sep 18, 2019

Researcher Drops phpMyAdmin Zero-Day Affecting All Versions
September 18, 2019
https://thehackernews.com/2019/09/phpmyadmin-csrf-exploit.html

A cybersecurity researcher recently published details and proof-of-concept for an unpatched zero-day vulnerability in phpMyAdmin—one of the most popular applications for managing the MySQL and MariaDB databases.

Discovered by security researcher and pentester Manuel Garcia Cardenas, the vulnerability claims to be a cross-site request forgery (CSRF) flaw, also known as XSRF, a well-known attack wherein attackers trick authenticated users into executing an unwanted action.
Identified as CVE-2019-12922, the flaw has been given a medium rating because of its limited scope that only allows an attacker to delete any server configured in the setup page of a phpMyAdmin panel on a victim's server.

However, the vulnerability is trivial to exploit because other than knowing the URL of a targeted server, an attacker doesn't need to know any other information, like the name of the databases.
Click to expand...

The flaw affects phpMyAdmin versions up to and including 4.9.0.1, which is the latest version of the software at the time of writing.
The security flaw also resides in phpMyAdmin 5.0.0-alpha1, which was released in July 2019, Cardenas told The Hacker News.

However, after phpMyAdmin maintainers failed to patch the vulnerability within 90 days of being notified, the researcher decided to release the vulnerability details and PoC to the public on 13 September.
Click to expand...

Log in or Sign up

Researcher Drops phpMyAdmin Zero-Day

guest Guest

Log in or Sign up

Researcher Drops phpMyAdmin Zero-Day

guest Guest

Useful Searches