# MA-745.092019: MyCERT Advisory - phpMyAdmin Vulnerability [CVE-2019-12922]

**Date:** 19 Sep 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-745.092019  
**Advisory ID:** MA-745.092019

---

**1.0 Introduction**
Recently, MyCERT received information from valid resources about exploits in phpMyAdmin. Exploit known to be as cross-site request forgery (CSRF) that will force authorized users to execute unwanted actions on web application. The flaw was identified as severe rating as its action only allows attacker to remove any configured setup page of phpMyAdmin panel on user’s server. However, this exploit has its limit as it does not grant to delete any database or table stored on server. PhpMyAdmin is an opensource tool to handle administration of MySQL and MariaDB on websites that widely utilize by individual, e-commerce, government, educational and etc.
**2.0 Impact**
The attacker will craft a malicious URL and sent out to targeted web administrators who has access to their phpMyAdmin panel on the same browser, tricking them to click on the link and it will remove the configured server unconsciously.
**3.0 Affected Products**
- phpMyAdmin <= 4.9.0.1
**4.0 Recommendations**
- Implement in each call the validation of the token variable, as already done in other phpMyAdmin requests.
- Avoid clicking any suspicious links until maintainers release patch to the public.
- Web admin requires to be aware with latest patch information from authorized maintainers and apply the patch as soon its release.
- IP whitelisting on trusted IP address or IP range only. If web admin does not utilize phpMyAdmin, we recommend to remove from web servers.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12922>
- <https://thehackernews.com/2019/09/phpmyadmin-csrf-exploit.html>
- <https://www.exploit-db.com/exploits/47385>