CVE-2011-2505 phpMyAdmin remote variable manipulation
MediumCVSS 6.4
EPSS 12.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin(Packagist) | >= 3.0, < 3.3.10.2 | 3.3.10.2 |
| phpmyadmin/phpmyadmin(Packagist) | >= 3.4, < 3.4.3.1 | 3.4.3.1 |
| debian/phpmyadmin(Debian:12) | < 4:3.4.3.1-1 | 4:3.4.3.1-1 |
| debian/phpmyadmin(Debian:14) | < 4:3.4.3.1-1 | 4:3.4.3.1-1 |
| debian/phpmyadmin(Debian:13) | < 4:3.4.3.1-1 | 4:3.4.3.1-1 |
| phpmyadmin/phpmyadmin | = 3.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.0-alpha | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.0-beta | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.0-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.1-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.1.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.0-beta1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.1-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.2-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.4-rc2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.5 | No fix listed |
Show 28 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin | = 3.1.5-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.0-beta1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.0-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.1-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.2-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.1.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.2.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.3.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.4.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.5.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.5.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.8.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.9.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.9.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.9.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.10.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.10.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.1.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.2.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- ha.xxor.se exploit
- FEDORA-2011-9144 vendor-advisory
- 8306 third-party-advisory
- typo3.org
- DSA-2286 vendor-advisory
- 17514 exploit
- [oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- www.phpmyadmin.net patch vendor-advisory
- Debian Security Tracker CVE-2011-2505 vendor-advisory
- github.com
- phpmyadmin.git.sourceforge.net
- 45139 third-party-advisory vendor-advisory
- 45292 third-party-advisory
- 45315 third-party-advisory
- MDVSA-2011:124 vendor-advisory
- 73611 vdb-entry
- 20110707 phpMyAdmin 3.x Multiple Remote Code Executions mailing-list
- www.xxor.se