phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution

HIGH 8.8CVE-2018-10188 · GHSA-v6fp-h79x-9rqc · Published 19/04/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
phpmyadmin/phpmyadmin Packagist	`≥ 4.8, < 4.8.0.1`	`4.8.0.1`
phpmyadmin phpmyadmin	`= 4.8.0`	No fix yet

Description

phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-10188 · ADVISORY
phpmyadmin/phpmyadmin commit c6dd6b5 · WEB
phpmyadmin/composer · PACKAGE
exploit-db.com/exploits/44496 · WEB
phpmyadmin.net/security/PMASA-2018-2 · WEB
securityfocus.com/bid/103936 · WEB
securitytracker.com/id/1040752 · WEB
exploit-db.com/exploits/44496 · Exploit
phpmyadmin.net/security/PMASA-2018-2 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free