漏洞描述
phpMyAdmin before 4.9.0 is susceptible to cross-site request forgery. An attacker can utilize a broken <img> tag which points at the victim's phpMyAdmin database, thus leading to potential delivery of a payload, such as a specific INSERT or DELETE statement.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request...↗www.securityfocus.comhttp://www.securityfocus.com/bid/108619↗lists.debian.orghttps://lists.debian.org/debian-lts-announce/2019/06/msg00009.html↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...↗lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedorapr...↗www.phpmyadmin.nethttps://www.phpmyadmin.net/security/↗www.phpmyadmin.nethttps://www.phpmyadmin.net/security/PMASA-2019-4/↗