PT-2011-3904 · Phpmyadmin · Phpmyadmin

Frans Pehrson · Published 2011-07-14 · Updated 2022-05-14 · CVE-2011-2505

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.x prior to 3.3.10.2 phpMyAdmin versions 3.4.x prior to 3.4.3.1

Description The Swekey authentication feature in phpMyAdmin assigns values to arbitrary parameters referenced in the query string, allowing remote attackers to modify the SESSION superglobal array via a crafted request. This issue is related to a remote variable manipulation vulnerability.

Recommendations For phpMyAdmin versions 3.x prior to 3.3.10.2, update to version 3.3.10.2 or later. For phpMyAdmin versions 3.4.x prior to 3.4.3.1, update to version 3.4.3.1 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-2505

DSA-2286-1

GHSA-VQCM-R62W-W437

Affected Products

Phpmyadmin

References · 34

• 🔥 http://exploit-db.com/exploits/17514 · Exploit
• 🔥 http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html · Exploit
• 🔥 https://exploit-db.com/exploits/17510 · Exploit
• 🔥 https://exploit-db.com/exploits/17514 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2011-2505 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2286 · Vendor Advisory
• http://phpmyadmin.net/home_page/security/PMASA-2011-5.php · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqcm-r62w-w437 · Vendor Advisory
• http://secunia.com/advisories/45139 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2505 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2505 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:124 · Vendor Advisory
• https://github.com/phpmyadmin/phpmyadmin/commit/6e6e129f26295c83d67b74e202628a4b8bc49e54 · Note