phpMoAdmin Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability has been identified in phpMoAdmin version 1.1.5. This vulnerability allows attackers to perform unauthorized database operations by sending crafted GET requests to moadmin.php. Exploitation involves tricking authenticated users into submitting these requests with specific parameters to manipulate databases and collections without their consent.

Impact

Exploitation of this vulnerability could lead to unauthorized database modifications, such as creating, dropping, or repairing databases and collections.

Reproduction

To reproduce this vulnerability, an attacker can create a form that sends a GET request to 'moadmin.php' with the desired database action and parameters. This form can then be presented to an authenticated user, who, upon submission, will unknowingly perform the requested database operation.