GitHub Advisoryadvisory · Packagist

GHSA-p6h7-29r2-g88f phpMyAdmin vulnerable to static code injection

HIGH Published 2022-05-14 Modified 2024-01-15 Official page ↗
Aliases
CVE-2011-2506
Ecosystem
Packagist
Packages
phpmyadmin/phpmyadmin
Severity
High
Weaknesses
CWE-94
Reviewed
2024-01-15

Affected packages

• Packagist phpmyadmin/phpmyadmin: >= 3.0, < 3.3.10.2 → fixed in 3.3.10.2 • Packagist phpmyadmin/phpmyadmin: >= 3.4, < 3.4.3.1 → fixed in 3.4.3.1

Description

`setup/lib/ConfigGenerator.class.php` in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.

Related

Alias · CVE (1)

  • CVE-2011-2506 setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References