Sponsored link
Serve your customers, not your servers, with VERIO Linux VPS. Full-access test-drive here.
| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
phpmyadmin: sql injection
| Package(s): | phpmyadmin | CVE #(s): | CVE-2008-1149 | ||||||
| Created: | March 10, 2008 | Updated: | April 25, 2008 | ||||||
| Description: | From the Gentoo advisory: Richard Cunningham reported that phpMyAdmin uses the $_REQUEST variable of $_GET and $_POST as a source for its parameters. An attacker could entice a user to visit a malicious web application that sets an "sql_query" cookie and is hosted on the same domain as phpMyAdmin, and thereby conduct SQL injection attacks with the privileges of the user authenticating in phpMyAdmin afterwards. | ||||||||
| Alerts: |
| ||||||||
(Log in to post comments)