I saw that there was a security exploit for phpMyAdmin using cross-site request forgery (CSRF). I always thought that the
?token= parameter in all phpMyAdmin URLs prevented against this, but then I read this:
To prepare a CSRF attack URL, the attacker should be aware of the name of targeted database and table.
That implies that the attacker doesn't need to know the token. I tested this by copying the link for the table drop button for a test DB in my phpMyAdmin, removing the
?token= parameter. To my surprise it did drop the table.
Is this token parameter intended to prevent CSRF? If not, which purpose does it serve?