← back
CVE-2008-1149

CVE-2008-1149

EPSS 0.9%
phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.htmlhttp://secunia.com/advisories/29143http://secunia.com/advisories/29200http://secunia.com/advisories/29287http://secunia.com/advisories/29964http://secunia.com/advisories/30816http://secunia.com/advisories/32834http://secunia.com/advisories/33822https://exchange.xforce.ibmcloud.com/vulnerabilities/40968https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html