PhpMyAdmin unserialize () Cross-Site Request Forgery Vulnerability

Affected Versions:

PhpMyAdmin 2.11.x

Vulnerability description:

Bugtraq id: 37861CVE (CAN) ID: CVE-2009-4605phpMyAdmin is a tool written in PHP for managing MySQL through the WEB. PhpMyAdmin uses the configuration and v [0] sent to the scripts/setup. php script.

Enter parameters to call the unserialize function. Remote attackers can execute cross-site request forgery attacks by submitting malicious requests,

Execute arbitrary commands with the permissions of other users.

<* Reference

Thomas Biege ( Thomas@suse.de)
Sebastian Krahmer ( Krahmer@suse.de)

Http://secunia.com/advisories/38211
Http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php

*>

Vendor patch: phpMyAdmin ---------- the current vendor has released the upgrade patch to fix this security problem, please download to the vendor's home page: http://www.phpmyadmin.net/