PT-2011-3904 · Phpmyadmin · Phpmyadmin

Frans Pehrson · Publicado 2011-07-14 · Atualizado 2022-05-14 · CVE-2011-2505

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.x prior to 3.3.10.2 phpMyAdmin versions 3.4.x prior to 3.4.3.1

Description The Swekey authentication feature in phpMyAdmin assigns values to arbitrary parameters referenced in the query string, allowing remote attackers to modify the SESSION superglobal array via a crafted request. This issue is related to a remote variable manipulation vulnerability.

Recommendations For phpMyAdmin versions 3.x prior to 3.3.10.2, update to version 3.3.10.2 or later. For phpMyAdmin versions 3.4.x prior to 3.4.3.1, update to version 3.4.3.1 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-2505

DSA-2286-1

GHSA-VQCM-R62W-W437

Produtos afetados

Phpmyadmin

Referências · 34

• 🔥 http://exploit-db.com/exploits/17514 · Exploit
• 🔥 http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html · Exploit
• 🔥 https://exploit-db.com/exploits/17510 · Exploit
• 🔥 https://exploit-db.com/exploits/17514 · Exploit
• https://github.com/phpmyadmin/phpmyadmin/commit/6e6e129f26295c83d67b74e202628a4b8bc49e54 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 · Nota
• https://github.com/phpmyadmin/composer/commit/7ebd958b2bf59f96fecd5b3322bdbd0b244a7967 · Nota
• https://github.com/phpmyadmin/composer · Nota
• http://openwall.com/lists/oss-security/2011/06/28/2 · Nota
• http://secunia.com/advisories/45315 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-2505 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html · Aviso do Fabricante
• http://debian.org/security/2011/dsa-2286 · Aviso do Fabricante
• http://phpmyadmin.net/home_page/security/PMASA-2011-5.php · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vqcm-r62w-w437 · Aviso do Fabricante