CVE-2006-5116 Cross-site request forgery in n/a

What is CVE-2006-5116?

CVE-2006-5116 is a medium-severity vulnerability in Phpmyadmin Phpmyadmin, published on 2 Oct 2006. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.

Which versions are affected by CVE-2006-5116?

It affects 1 product.

Products include Phpmyadmin Phpmyadmin.

How do I fix CVE-2006-5116?

Upgrade to a fixed version.

Is CVE-2006-5116 being exploited?

There is no known exploitation of CVE-2006-5116 in the wild and no public exploit code.

Other vulnerabilities in Phpmyadmin Phpmyadmin

• CVE-2008-7251 Misconfiguration in n/a Critical 10.0
• CVE-2008-7252 phpMyAdmin unsafely handles temporary files Critical 10.0
• CVE-2007-0203 Other in n/a Critical 10.0
• CVE-2004-1147 Command injection in n/a Critical 10.0
• CVE-2020-22452 phpmyadmin contains SQL Injection vulnerability Critical 9.8

All Phpmyadmin Phpmyadmin vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2006-5116, GHSA-782v-4ghj-5xm3.