Strix
26.1K

CVE-2006-5116

UnknownEPSS 2.02%

Last modified

CVE-2006-5116 is a vulnerability of currently unknown severity. Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.. EPSS estimates a 2.02% chance of exploitation in the next 30 days.

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.

Metrics

EPSS Probability
2.02%

78.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
PhpmyadminPhpmyadmin2.8.0.1
PhpmyadminPhpmyadmin2.8.0.2
PhpmyadminPhpmyadmin2.8.0.3
PhpmyadminPhpmyadmin2.8.1
PhpmyadminPhpmyadmin2.8.1_dev
PhpmyadminPhpmyadmin2.8.3
PhpmyadminPhpmyadmin2.8.4
PhpmyadminPhpmyadmin2.9.0_dev

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2006-5116?
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.
How severe is CVE-2006-5116?
Severity scoring for CVE-2006-5116 is pending analysis. The EPSS model estimates a 2.02% probability of exploitation in the next 30 days.
How do I fix CVE-2006-5116?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2006-5116?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST