DescriptionCross-site request forgery (CSRF) vulnerability in phpMyAdmin before allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
NVD severitylow (attack range: remote, user-initiated)
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
phpmyadmin (PTS)squeeze, squeeze (security)4:3.3.7-7fixed
squeeze (lts)4:3.3.7-8fixed
wheezy (security), wheezy4:
stretch, sid4:

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


this only allows via csrf to create an empty database.
this would take a lot of work to get it only to the 'annoying' level, let alone a DoS

Search for package or bug name: Reporting problems