Vulnerability Details : CVE-2017-1000499
Public exploit exists!
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2017-1000499
- cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
Threat overview for CVE-2017-1000499
Top countries where our scanners detected CVE-2017-1000499
Top open port discovered on systems with this issue
80
IPs affected by CVE-2017-1000499 3
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-1000499!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-1000499
15.48%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-1000499
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-1000499
-
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-1000499
-
http://www.securitytracker.com/id/1040163
phpMyAdmin Access Control Flaw Lets Remote Users Conduct Cross-Site Request Forgery Attacks - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/45284/
phpMyAdmin 4.7.x - Cross-Site Request ForgeryExploit;Third Party Advisory;VDB Entry
-
https://www.phpmyadmin.net/security/PMASA-2017-9/
phpMyAdmin - Security - PMASA-2017-9Patch;Vendor Advisory
-
http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/
This Vulnerability in phpMyAdmin Lets An Attacker Perform DROP TABLE With A Single Click! - Cyber World MirrorExploit;Patch;Third Party Advisory
Jump to