CVE-2008-1149

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.1 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
VendorProductVersion
phpmyadminphpmyadmin
𝑥
≤ 2.11.4
phpmyadminphpmyadmin
2.11.0
phpmyadminphpmyadmin
2.11.0:beta1
phpmyadminphpmyadmin
2.11.0:rc1
phpmyadminphpmyadmin
2.11.0.0
phpmyadminphpmyadmin
2.11.1
phpmyadminphpmyadmin
2.11.1:rc1
phpmyadminphpmyadmin
2.11.1.0
phpmyadminphpmyadmin
2.11.1.1
phpmyadminphpmyadmin
2.11.1.2
phpmyadminphpmyadmin
2.11.2
phpmyadminphpmyadmin
2.11.2.0
phpmyadminphpmyadmin
2.11.2.1
phpmyadminphpmyadmin
2.11.2.2
phpmyadminphpmyadmin
2.11.3
phpmyadminphpmyadmin
2.11.3:rc1
phpmyadminphpmyadmin
2.11.3.0
phpmyadminphpmyadmin
2.11.4:rc1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
phpmyadmin
bullseye
4:5.0.4+dfsg2-2+deb11u1
fixed
etch
no-dsa
sarge
not-affected
bookworm
4:5.2.1+dfsg-1
fixed
sid
4:5.2.1+dfsg-4
fixed
trixie
4:5.2.1+dfsg-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
phpmyadmin
gutsy
Fixed 4:2.10.3-1ubuntu0.2
released
feisty
Fixed 4:2.9.1.1-2ubuntu1.2
released
edgy
Fixed 4:2.8.2-0.2ubuntu0.1
released
dapper
Fixed 4:2.8.0.3-1ubuntu0.1
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
http://secunia.com/advisories/29143
http://secunia.com/advisories/29200
http://secunia.com/advisories/29287
http://secunia.com/advisories/29964
http://secunia.com/advisories/30816
http://secunia.com/advisories/32834
http://secunia.com/advisories/33822
http://www.debian.org/security/2008/dsa-1557
http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:131
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1
http://www.securityfocus.com/bid/28068
http://www.vupen.com/english/advisories/2008/0731
http://www.vupen.com/english/advisories/2008/0758
https://exchange.xforce.ibmcloud.com/vulnerabilities/40968
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
http://secunia.com/advisories/29143
http://secunia.com/advisories/29200
http://secunia.com/advisories/29287
http://secunia.com/advisories/29964
http://secunia.com/advisories/30816
http://secunia.com/advisories/32834
http://secunia.com/advisories/33822
http://www.debian.org/security/2008/dsa-1557
http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:131
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1
http://www.securityfocus.com/bid/28068
http://www.vupen.com/english/advisories/2008/0731
http://www.vupen.com/english/advisories/2008/0758
https://exchange.xforce.ibmcloud.com/vulnerabilities/40968
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html