CVE-2018-19969

Vulnerability

phpMyAdmin versions 4.7.0 through 4.7.6 and 4.8.0 through 4.8.3 are affected by a series of cross-site request forgery (CSRF) vulnerabilities [1][2]. The flaws exist in various actions that lack proper CSRF token validation, allowing an attacker to craft a malicious URL and trick an authenticated user into visiting it [1][2]. The attack can be executed against any user who has an active phpMyAdmin session [1].

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL that points to specific phpMyAdmin actions (e.g., renaming databases, creating tables, adding/deleting users, updating passwords) and then deceiving an authenticated user into clicking the link [1][2]. No special network position or authentication is needed; the attacker only needs to lure the user, who must be logged into phpMyAdmin. The action is executed in the context of the victim's session [1][2].

Impact

Successful exploitation allows the attacker to perform harmful SQL operations such as renaming databases, creating new tables or routines, deleting designer pages, adding or deleting users, updating user passwords, and killing SQL processes [1][2]. This could lead to unauthorized data modification, privilege escalation, or denial of service within the database managed by phpMyAdmin [2].

Mitigation

Upgrade to phpMyAdmin version 4.8.4 or later, which was released on December 7, 2018, and contains the fix [2][3]. Patches are also available via multiple commits on the 4.8 branch [2]. For Gentoo Linux users, the package should be upgraded to >=dev-db/phpmyadmin-4.8.4 [4]. No workaround is available for unpatched versions [2][4].