PT-2011-3905 · Phpmyadmin · Phpmyadmin

Frans Pehrson · Publicado 2011-07-14 · Atualizado 2022-05-14 · CVE-2011-2506

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.x through 3.3.10.1 phpMyAdmin versions 3.4.x through 3.4.3.0

Description The issue allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array, due to the improper restriction of comment closing delimiters in the setup/lib/ConfigGenerator.class.php file.

Recommendations For phpMyAdmin versions 3.x through 3.3.10.1, update to version 3.3.10.2 or later. For phpMyAdmin versions 3.4.x through 3.4.3.0, update to version 3.4.3.1 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-2506

DSA-2286-1

GHSA-P6H7-29R2-G88F

Produtos afetados

Phpmyadmin

Referências · 34

• 🔥 http://exploit-db.com/exploits/17514 · Exploit
• 🔥 http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html · Exploit
• 🔥 https://exploit-db.com/exploits/17510 · Exploit
• 🔥 https://exploit-db.com/exploits/17514 · Exploit
• https://github.com/phpmyadmin/phpmyadmin/commit/2e01647949df937040e73a94ce0bac0daecbdcf4 · Nota
• https://github.com/phpmyadmin/phpmyadmin/commit/0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f · Nota
• https://github.com/phpmyadmin/composer · Nota
• http://openwall.com/lists/oss-security/2011/06/28/2 · Nota
• http://secunia.com/advisories/45315 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html · Aviso do Fabricante
• http://phpmyadmin.net/home_page/security/PMASA-2011-6.php · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2506 · Aviso do Fabricante
• http://debian.org/security/2011/dsa-2286 · Aviso do Fabricante
• http://securityfocus.com/archive/1/518804/100/0/threaded · Nota
• http://secunia.com/advisories/45139 · Aviso do Fabricante