CVE-2018-10188 phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution
HighCVSS 8.8
EPSS 4.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin(Packagist) | >= 4.8, < 4.8.0.1 | 4.8.0.1 |
| phpmyadmin/phpmyadmin(Packagist) | = 4.8.0 | No fix listed |
| debian/phpmyadmin(Debian:12) | < 4:4.9.1+dfsg1-2 | 4:4.9.1+dfsg1-2 |
| debian/phpmyadmin(Debian:13) | < 4:4.9.1+dfsg1-2 | 4:4.9.1+dfsg1-2 |
| debian/phpmyadmin(Debian:14) | < 4:4.9.1+dfsg1-2 | 4:4.9.1+dfsg1-2 |
| phpmyadmin/phpmyadmin | = 4.8.0 | No fix listed |
| alpine/phpmyadmin(Alpine:v3.19) | < 4.8.0-r1 | 4.8.0-r1 |
| alpine/phpmyadmin(Alpine:v3.20) | < 4.8.0-r1 | 4.8.0-r1 |
| alpine/phpmyadmin(Alpine:v3.21) | < 4.8.0-r1 | 4.8.0-r1 |
| alpine/phpmyadmin(Alpine:v3.22) | < 4.8.0-r1 | 4.8.0-r1 |
| alpine/phpmyadmin(Alpine:v3.23) | < 4.8.0-r1 | 4.8.0-r1 |
| alpine/phpmyadmin(Alpine:v3.24) | < 4.8.0-r1 | 4.8.0-r1 |
References
- Debian Security Tracker CVE-2018-10188 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- 44496 exploit third-party-advisory vdb-entry
- www.phpmyadmin.net vendor-advisory
- 103936 third-party-advisory vdb-entry
- 1040752 third-party-advisory vdb-entry
- github.com
- security.alpinelinux.org vendor-advisory