PMASA-2019-4
Announcement-ID: PMASA-2019-4
Date: 2019-06-04
Summary
CSRF vulnerability in login form
Description
A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) through the victim.
Severity
We consider this vulnerability to be severe.
Mitigation factor
Only the 'cookie' auth_type is affected; users can temporary use phpMyAdmin's http authentication as a workaround.
Affected Versions
All versions prior to phpMyAdmin 4.9.0 are affected, probably at least as old as version 4.0 (perhaps even earlier)
Solution
Upgrade to phpMyAdmin 4.9.0 or newer or apply patch listed below.
References
Thanks to Mauro Tempesta for reporting this vulnerability
Assigned CVE IDs: CVE-2019-12616
CWE IDs: CWE-661
Patches
The following commits have been made to fix this issue:
More information
For further information and in case of questions, please contact the phpMyAdmin security team at security@phpmyadmin.net.