{"id":"CVE-2017-1000499","aliases":["EUVD-2022-3737","GHSA-f9hx-5jq4-fgjm","openSUSE-SU-2018:0534-1","openSUSE-SU-2018:0536-1","openSUSE-SU-2024:11171-1"],"status":"published","title":"phpMyAdmin CSRF Vulnerability","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.08464,"percentile":0.9506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-352"],"published":"2018-01-03T14:00:00Z","modified":"2026-10-24T10:30:30Z","exploits":[{"source":"exploitdb","id":"EDB-45284","title":"phpMyAdmin 4.7.x - Cross-Site Request Forgery","type":"webapps","platform":"php","date":"2018-08-29","verified":true,"url":"https://www.exploit-db.com/exploits/45284"},{"source":"pocgithub","id":"Villaquiranm/5MMISSI-CVE-2017-1000499","title":"Villaquiranm/5MMISSI-CVE-2017-1000499","date":"2019-01-05","url":"https://github.com/Villaquiranm/5MMISSI-CVE-2017-1000499"}],"fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.7.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7"},{"fixed":"4.7.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7"},{"fixed":"4.7.7"}]}],"versions":["4.7.0","4.7.1","4.7.2","4.7.3","4.7.4","4.7.5","4.7.6"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.2"}]}],"bundled":31}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"http://www.securitytracker.com/id/1040163","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/45284/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2017-9/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000499","tags":["advisory"]},{"url":"https://web.archive.org/web/20201208204518/http://www.securitytracker.com/id/1040163","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f9hx-5jq4-fgjm"},{"url":"https://www.exploit-db.com/exploits/45284","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2017-9","tags":["web"]},{"url":"http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082188","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5504","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-1000499","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","status":"published","published":"2018-01-03T14:00:00Z","modified":"2024-08-05T22:00:41.653Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2022-3737","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","status":"published","published":"2018-01-03T14:00:00Z","modified":"2024-08-05T22:00:41Z","updated_at":"2026-11-03T02:23:03.159581Z"}],"ghsa":[{"id":"GHSA-f9hx-5jq4-fgjm","title":"phpMyAdmin CSRF Vulnerability","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","status":"published","published":"2022-05-14T01:05:59Z","modified":"2023-09-13T11:41:55Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:37:05.004935Z"}],"nvd":[{"id":"CVE-2017-1000499","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","status":"published","published":"2018-01-03T14:29:00.41Z","modified":"2026-06-17T00:59:17.077Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:04:12.690425Z"}],"osv":[{"id":"CVE-2017-1000499","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","status":"published","published":"2018-01-03T14:29:00.41Z","modified":"2026-10-24T10:30:30.36370282Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"GHSA-f9hx-5jq4-fgjm","title":"phpMyAdmin CSRF Vulnerability","description":"phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.","status":"published","published":"2022-05-14T01:05:59Z","modified":"2024-02-18T05:19:20.539196Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"openSUSE-SU-2018:0534-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin 4.7.8 fixes the following issues:\n\n- CVE-2018-7260: self-cross site scripting (XSS) vulnerability in the central columns feature (boo#1082188)\n    \nThis version also fixes some minor functionality bugs.\nThe previous update already fixed CVE-2017-1000499.\n","status":"published","published":"2018-02-24T09:13:38Z","modified":"2026-02-04T02:37:10.790548Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2018:0536-1","title":"Security update for phpMyAdmin","description":"This update for phpMyAdmin 4.7.8 fixes the following issues:\n\n- CVE-2018-7260: self-cross site scripting (XSS) vulnerability in the central columns feature (boo#1082188)\n    \nThis version also fixes some minor functionality bugs.\nThe previous update already fixed CVE-2017-1000499.\n","status":"published","published":"2018-02-24T09:13:38Z","modified":"2026-02-04T02:44:54.797848Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:11171-1","title":"phpMyAdmin-5.1.1-1.2 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.1.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:16.460481Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}