An issue was discovered in phpMyAdmin before 4.9.0.

Summary

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.

Timeline

1. Jun 5, 2019, 4:27 AM UTCCVE published
2. Jun 11, 2019Public exploit on Exploit-DB

   EDB-46982

3. Aug 4, 2024, 11:24 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• phpmyadmin/phpmyadminPackagist

  fixed in 4.9.0

References 11