#VU44889 Code Injection in phpMyAdmin - CVE-2011-2505

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU44889

#VU44889 Code Injection in phpMyAdmin - CVE-2011-2505

Published: July 15, 2011 / Updated: August 11, 2020


Vulnerability identifier: #VU44889
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2011-2505
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
phpMyAdmin
Software vendor:
phpMyAdmin

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."


Remediation

Install update from vendor's website.

External links