← Database

CVE-2008-1149

MEDIUM CVSS: 5.1 Published: 2008-03-04 Modified: 2026-06-16

Description

phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.

Affected Platforms

Phpmyadmin Phpmyadmin

Weakness Type

CWE-89, CWE-352

References