CVE-2011-2506 phpMyAdmin vulnerable to static code injection
HighCVSS 7.5
EPSS 9.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin(Packagist) | >= 3.0, < 3.3.10.2 | 3.3.10.2 |
| phpmyadmin/phpmyadmin(Packagist) | >= 3.4, < 3.4.3.1 | 3.4.3.1 |
| debian/phpmyadmin(Debian:12) | < 4:3.4.3.1-1 | 4:3.4.3.1-1 |
| debian/phpmyadmin(Debian:14) | < 4:3.4.3.1-1 | 4:3.4.3.1-1 |
| debian/phpmyadmin(Debian:13) | < 4:3.4.3.1-1 | 4:3.4.3.1-1 |
| phpmyadmin/phpmyadmin | = 3.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.0-alpha | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.0-beta | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.0-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.1-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.0.1.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.0-beta1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.1-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.2-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.3.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.4 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.4-rc2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.1.5 | No fix listed |
Show 28 more
| Product | Affected versions | Fixed in |
|---|---|---|
| phpmyadmin/phpmyadmin | = 3.1.5-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.0-beta1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.0-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.1-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.2.2-rc1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.1.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.2.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.3.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.4.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.5.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.5.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.6 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.7 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.8 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.8.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.9.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.9.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.9.2 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.10.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.3.10.1 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.0.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.1.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.2.0 | No fix listed |
| phpmyadmin/phpmyadmin | = 3.4.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- ha.xxor.se exploit
- FEDORA-2011-9144 vendor-advisory
- phpmyadmin.git.sourceforge.net
- 8306 third-party-advisory
- typo3.org
- DSA-2286 vendor-advisory
- 17514 exploit
- [oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- www.phpmyadmin.net patch vendor-advisory
- Debian Security Tracker CVE-2011-2506 vendor-advisory
- github.com
- phpmyadmin.git.sourceforge.net
- 45139 third-party-advisory vendor-advisory
- 45292 third-party-advisory
- 45315 third-party-advisory
- MDVSA-2011:124 vendor-advisory
- 73612 vdb-entry
- 20110707 phpMyAdmin 3.x Multiple Remote Code Executions mailing-list
- www.xxor.se