Pierluigi Paganini January 02, 2018

The development team of phpMyAdmin has fixed a CSRF vulnerability in phpMyAdmin that could be exploited by attackers for removing items from shopping cart.

Researcher Ashutosh Barot has discovered a critical CSRF vulnerability in phpMyAdmin that could be exploited by attackers to perform malicious operations like drop tables and delete records.

phpMyAdmin developers released the version 4.7.7 that addresses the CSRF vulnerability found by Barot.

“By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.” reads the security advisory published by phpMyAdmin developers.

An attacker could trick a database admin into performing database operations like DROP TABLE using CSRF with devastating consequences.

“In this case, a CSRF vulnerability allows an attacker to send a crafted URL to the victim and if she (authenticated user) clicks it, the victim may perform a DROP TABLE query on her database. phpMyAdmin team considers this issue as critical vulnerability.” reads the analysis published by Ashutosh Barot.

This means that an attacker can create a crafted URL and trick the victims having an active session into performing dangerous operations without their knowledge.

The expert discovered a feature in phpMyAdmin that uses GET requests for Database operations such as DROP TABLE table_name, this means that it is possible for an attacker to trick a database admin into clicking a button and perform a database query of the attacker’s choice.

Ashutosh Barot also discovered that the URL for performing database operations was being saved in the browser history, an attacker can access them to gain some information about the database.

“Any query you execute by clicking insert, DROP, etc., button as shown in above image . The URL will contain database name and table name as GET request was used to perform DB Operations. URLs are stored at various places such as browser history, SIEM logs, Firewall Logs, ISP Logs, etc. this URL is always visible at client side, it can be a serious issue if you are not using SSL (some information about your previous queries were stored in someone’s logs!)” continues the analysis. 

The expert pointed out that the CSRF attack worked even when the user was authenticated in cPanel and phpMyAdmin was closed after use.

The vulnerability is ranked as Medium severity because its exploitation needs the user interaction.

Below a video PoC published by Barot:

All versions prior 4.7.7 are affected by the vulnerability, users must update their installations or apply the following patches:

The following commits have been made on the 4.7 branch to fix this issue:

• edd929216ade9f7c150a262ba3db44db0fed0e1b

The following commits have been made on the 4.8 branch to fix this issue:

• 72f109a99c82b14c07dcb19946ba9b76efc32a1b

Pierluigi Paganini

(Security Affairs – phpMyAdmin, CSRF)

[adrotate banner=”5″]

[adrotate banner=”13″]