CVE-2008-1149: SQL Injection
Published Mar 4, 2008
·Updated
phpMyAdmin before 2.11.5 accesses $REQUEST to obtain some parameters instead of $GET and $POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
Affected Software
18 affected components
phpMyAdmin phpMyAdmin<=2.11.4
phpMyAdmin phpMyAdmin=2.11.0
phpMyAdmin phpMyAdmin=2.11.0-beta1
phpMyAdmin phpMyAdmin=2.11.0-rc1
phpMyAdmin phpMyAdmin=2.11.0.0
phpMyAdmin phpMyAdmin=2.11.1
phpMyAdmin phpMyAdmin=2.11.1-rc1
phpMyAdmin phpMyAdmin=2.11.1.0
phpMyAdmin phpMyAdmin=2.11.1.1
phpMyAdmin phpMyAdmin=2.11.1.2
phpMyAdmin phpMyAdmin=2.11.2
phpMyAdmin phpMyAdmin=2.11.2.0
phpMyAdmin phpMyAdmin=2.11.2.1
phpMyAdmin phpMyAdmin=2.11.2.2
phpMyAdmin phpMyAdmin=2.11.3
phpMyAdmin phpMyAdmin=2.11.3-rc1
phpMyAdmin phpMyAdmin=2.11.3.0
phpMyAdmin phpMyAdmin=2.11.4-rc1
Remediation
Patch Available
Patch Available
Event History
Mar 4, 2008
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-1149?
CVE-2008-1149 is classified as a high severity vulnerability due to its potential for SQL injection and CSRF attacks.
2
How do I fix CVE-2008-1149?
To fix CVE-2008-1149, upgrade to phpMyAdmin version 2.11.5 or later.
3
What types of attacks can exploit CVE-2008-1149?
CVE-2008-1149 can be exploited to conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks.
4
Which versions of phpMyAdmin are affected by CVE-2008-1149?
CVE-2008-1149 affects phpMyAdmin versions prior to 2.11.5, including 2.11.0 to 2.11.4.
5
Who can be targeted by CVE-2008-1149 exploits?
Attackers on the same domain can target vulnerable phpMyAdmin installations using crafted cookies.