Every CVESearch/Get API key

CVE-2008-1149

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST...

5.1 MediumFix available

CVE-2008-1149 is a medium vulnerability (CVSS 5.1) in Phpmyadmin, published March 4, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in phpmyadmin 4:2.11.5-1.

What does this mean?
Severity
5.1 MediumCVSS 2.0, NVD
Exploit chance
0.91%EPSS, 60th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4:2.11.5-1phpmyadmin +3 more

Description

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Exploit likelihood

0.91%Down 1.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
phpmyadmin
Debian:12
before 4:2.11.5-1
4:2.11.5-1
phpmyadmin
Debian:13
before 4:2.11.5-1
4:2.11.5-1
phpmyadmin
Debian:14
before 4:2.11.5-1
4:2.11.5-1
phpmyadmin
Debian:4.0
From an advisory covering 3 CVEs
before 4:2.9.1.1-7, plus listed versions
4:2.9.1.1-34:2.9.1.1-44:2.9.1.1-54:2.9.1.1-6
4:2.9.1.1-7

What each source reports

NVD Score used5.1

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Record
CVE-2008-1149
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness
CWE-89, CWE-352
Updated
2026-11-02
CVE ListNo score

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Record
CVE-2008-1149
Updated
2026-11-02
EUVDEUVD-2008-1158No score

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Record
EUVD-2008-1158
Updated
2026-11-03
GitHub AdvisoriesGHSA-p842-vv7g-4q9vNo score

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST...

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Record
GHSA-p842-vv7g-4q9v
Weakness
CWE-89, CWE-352
Updated
2026-11-02
OSVNo score

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Record
CVE-2008-1149
Updated
2026-11-02
OSVDEBIAN-CVE-2008-1149No score

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Record
DEBIAN-CVE-2008-1149
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 16 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open