CVE-2011-0987 — Improper Input Validation in Phpmyadmin

CWE-20 — Improper Input Validation4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
2.7%
top 14.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedFeb 14
Latest updateMay 17

Description

The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL query by creating a bookmark.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:3.3.9.2-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:3.3.9.2-1+3
▶NVDphpmyadmin/phpmyadmin55 versions+54

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-36hv-fqvj-3wq3: The PMA_Bookmark_get function in libraries/bookmark↗2022-05-17
▶
OSV
CVE-2011-0987: The PMA_Bookmark_get function in libraries/bookmark↗2011-02-14
▶

📋Vendor Advisories

1
Debian
CVE-2011-0987: phpmyadmin - The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x...↗2011
▶