CSRF Vulnerability in phppgadmin Affects Administrators
CVE-2019-10784

9.6CRITICAL

Key Information:

Vendor

PHPpgadmin Project

Status
PHPpgadmin
Vendor
CVE Published:
4 February 2020

What is CVE-2019-10784?

The phppgadmin application, up to version 7.12.1, is vulnerable to Cross-Site Request Forgery (CSRF), allowing unauthorized actions to be executed without verifying the origin of the request. Specifically, the 'database.php' file lacks necessary checks, enabling a remote attacker to deceive an authenticated administrator into accessing a malicious link. This can lead to the execution of arbitrary system commands on the server, posing significant security risks.

Affected Version(s)

phppgadmin All versions

References

https://snyk.io/vuln/SNYK-PHP-PHPPGADMINPHPPGADMIN-543885
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.