Description

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Remediation

References

CVE-2008-1149

Related Vulnerabilities

MyBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-9417)

PHP Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2006-5178)

Joomla! Core 2.5.x Cross-Site Scripting (2.5.0 - 2.5.14)

WordPress Plugin Pierre's Wordspew 'wordspew.php' Multiple SQL Injection Vulnerabilities (5.61)

Lighttpd Missing Release of Memory after Effective Lifetime Vulnerability (CVE-2022-41556)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-352 CVE-2008-1149