phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements,
    related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
    (CVE-2018-10188)

The version of phpMyAdmin installed on the remote host permits an attack to deceive a user into clicking on a crafted URL link, which may permit the attacker to execute arbitrary SQL commands. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for phpMyAdmin to version 4.8.0.1 fixes the following issues :

  - CVE-2018-10188: Possible execution of arbitrary SQL     statements via manipulated URLs (boo#1090309)

This version also contains a number of upstream changes, improvements, new functions and bug fixes.

ID	Name	Product	Family	Severity
433495	SCA: security update for phpmyadmin/phpmyadmin (GHSA-v6fp-h79x-9rqc)	Tenable Cloud Security	SCA Checks	high
433495	SCA: security update for phpmyadmin/phpmyadmin (GHSA-v6fp-h79x-9rqc)	Tenable Self-Hosted Container Security	SCA Checks	high
408093	Alpine: multiple phpmyadmin packages: security update to 4.8.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
408093	Alpine: multiple phpmyadmin packages: security update to 4.8.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406394	Alpine: multiple phpmyadmin packages: security update to 4.8.0.-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406394	Alpine: multiple phpmyadmin packages: security update to 4.8.0.-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400687	Alpine: multiple phpmyadmin packages: security update to 4.8.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400687	Alpine: multiple phpmyadmin packages: security update to 4.8.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
113287	phpMyAdmin 4.8.x < 4.8.0-1 Cross-Site Request Forgery	Web App Scanning	Component Vulnerability	high
109292	openSUSE Security Update : phpMyAdmin (openSUSE-2018-387)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-10188

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high