CVE-2017-1000499: phpmyadmin Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2017-1000499 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in phpmyadmin. EPSS estimates a 8.46% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 03-01-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
8.46%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
-0.31 pp
From 8.78% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (cyberworldmirror.com)
Maturity: unknown
phpMyAdmin 4.7.x - Cross-Site Request Forgery
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Phpmyadmin1 product
- phpmyadmin≥ 4.7.0, < 4.7.7
1 vendor · 1 product
References
4 links- cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/X Refsource MISCExploitPatchThird Party Advisory