Описание
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
A flaw was found in phpMyAdmin. A remote attacker can execute arbitrary database queries by bypassing cross-site request forgery (CSRF) token validation on standard HTTP POST requests. By tricking an authenticated user into submitting a crafted cross-site request, an attacker can execute SQL commands with the privileges of the victim's database account.
Отчет
Important impact is assigned to this flaw because unauthorized database commands can be triggered within the context of an authenticated session, potentially resulting in complete compromise of database integrity and confidentiality. Although exploitation hinges on tricking an active user into submitting a forged submission, the full database privileges granted to an administrative victim elevate the risk beyond Moderate severity. phpMyAdmin is not distributed in supported Red Hat Enterprise Linux releases, though it is distributed via community repositories such as EPEL.
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnera ...
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
EPSS
7.5 High
CVSS3