CVE-2011-2505
Summary
| CVE | CVE-2011-2505 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-07-14 23:55:04 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability." |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:N/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | alpha | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | beta | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.0 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.1 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.0.1.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.0 | beta1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.1 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.2 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.3.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.4 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.4 | rc2 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.5 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.1.5 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.0 | beta1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.0 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.1 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.2.2 | rc1 | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.1.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.10.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.10.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.2.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.3.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.4.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.5.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.5.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.6 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.7 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.8 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.8.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.9.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.9.1 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.3.9.2 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.0.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.1.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.2.0 | All | All | All |
| Application | Phpmyadmin | Phpmyadmin | 3.4.3.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| phpMyAdmin 3.x Multiple Remote Code Executions - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| oss-security - CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Haxxor Security: phpMyAdmin 3.x Multiple Remote Code Executions | af854a3a-2127-422b-91ae-364da2661108 | ha.xxor.se | Exploit |
| Debian -- Security Information -- DSA-2286-1 phpmyadmin | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| TYPO3 - the Enterprise Open Source CMS: TYPO3 Security Bulletin TYPO3-SA-2011-008 | af854a3a-2127-422b-91ae-364da2661108 | typo3.org | |
| [SECURITY] Fedora 14 Update: phpMyAdmin-3.4.3.1-1.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| phpMyAdmin Multiple Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| oss-security - Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Fedora update for phpMyAdmin - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| phpMyAdmin 3.x Swekey Remote Code Injection Exploit | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | Exploit |
| oss-security - Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt | af854a3a-2127-422b-91ae-364da2661108 | www.xxor.se | |
| phpMyAdmin - Security - PMASA-2011-5 | af854a3a-2127-422b-91ae-364da2661108 | www.phpmyadmin.net | Patch, Vendor Advisory |
| www.osvdb.org/73611 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| oss-security - Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian update for phpmyadmin - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Just a moment... | af854a3a-2127-422b-91ae-364da2661108 | phpmyadmin.git.sourceforge.net | |
| Security Advisories | Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| phpMyAdmin / None tools | MITRE | phpmyadmin.git.sourceforge.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.