News Feed
Sections




News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way

Hardened-PHP Project:
Advisory - phpMyAdmin Multiple CSRF Vulnerabilities
October 02, 2006 @ 09:51:00

The Hardened-PHP Project has issued another advisory today, this time effecting the popular database administration package phpMyAdmin.

During an audit of phpMyAdmin's protection against CSRF: Cross Site Request Forgeries we discovered that there were multiple ways to bypass the protection.

The failure of phpMyAdmin's CSRF protection obviously means that a potential attacker can use CSRF attacks to trick the browser of a phpMyAdmin user to execute any kind of SQL queries on the victims database server.

The advisory mentions the source of the problem - a random token that is in the user's session that could be exploited to gain unauthorized access to an account. Their recommendation is to update to the latest version of phpMyAdmin (2.9.0.1 as of the time of this post) to help resolve the issue.

0 comments voice your opinion now!
phpmyadmin csrf vulnerability multiple advisory phpmyadmin csrf vulnerability multiple advisory


blog comments powered by Disqus

Similar Posts

PHPMaster.com: Using Traits in PHP 5.4

Scarletlullaby.com: Refactoring to Rails (MVC) in PHP

Secunia.com: WordPress myGallery Plugin "myPath" File Inclusion

SecurityReason: Three Advisories for PHP 5.2.4 (dl, iconv_substr & setlocale)

Secunia.com: PHP Integer Overflow Vulnerability and Security Bypass


Community Events





Don't see your event here?
Let us know!


community podcast framework list conference laravel unittest composer opinion voicesoftheelephpant version series api symfony configure introduction threedevsandamaybe language interview release

All content copyright, 2015 PHPDeveloper.org :: info@phpdeveloper.org - Powered by the Solar PHP Framework