CVE-2011-2507 — Code Injection in Phpmyadmin

CWE-94 — Code Injection4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
3.7%
top 11.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpmyadminDebian Phpmyadmin
Timeline
PublishedJul 14
Latest updateMay 14

Description

libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/phpmyadmin< phpmyadmin 4:3.4.3.1-1 (bookworm)
▶Debianphpmyadmin/phpmyadmin< 4:3.4.3.1-1+3
▶NVDphpmyadmin/phpmyadmin34 versions+33

Patches

Patch: www.phpmyadmin.net ↗Patch: www.phpmyadmin.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-rm5v-f378-qgp9: libraries/server_synchronize↗2022-05-14
▶
OSV
CVE-2011-2507: libraries/server_synchronize↗2011-07-14
▶

📋Vendor Advisories

1
Debian
CVE-2011-2507: phpmyadmin - libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyA...↗2011
▶