New phpMyAdmin Zero-Day Vulnerability Found


Researcher publishes details, proof of concept.

phpMyAdmin, despite its popularity, doesn’t have the reputation of being overly secure. Many sysadmins advise not to install it.

Researcher Manuel Garcia Cardenas has found a new vulnerability in phpMyAdmin and published details, along with proof-of-concept, that could be used by bad actors. The flaw has been assigned CVE-2019-12922.

According to Cardenas, the vulnerability is a Cross-Site Request Forgery in phpMyAdmin that allows an attacker to trigger a CSRF attack against a phpMyAdmin user by deleting any server in the Setup page.

“The attacker can easily create a fake hyperlink containing the request that wants to execute on behalf of the user, in this way making possible a CSRF attack due to the wrong use of HTTP method,” Cardenas explains in a post to the Full Disclosure mailing list.

phpMyAdmin maintainers have not yet released a patch for the vulnerability.


Related content

comments powered by Disqus
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs

Support Our Work

ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.

Learn More”>


		<div class=