Home > Vulnerability Database > CVE-2011-2505

Mend.io Vulnerability Database

CVE-2011-2505

Date: July 14, 2011

libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."

Language: PHP

Severity Score

6.5

Related Resources (30)

Url: https://web.archive.org/web/20111116172111/http://www.securityfocus.com/archive/1/518804/100/0/threaded

Url: https://github.com/phpmyadmin/phpmyadmin/commit/6e6e129f26295c83d67b74e202628a4b8bc49e54

Url: http://www.osvdb.org/73611

Url: http://secunia.com/advisories/45292

Url: https://github.com/phpmyadmin/composer/commit/7ebd958b2bf59f96fecd5b3322bdbd0b244a7967

Url: http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt

Url: http://www.securityfocus.com/archive/1/518804/100/0/threaded

Url: http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008

Url: https://nvd.nist.gov/vuln/detail/CVE-2011-2505

Url: http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/

Url: http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php

Url: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html

Url: http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967

Url: https://web.archive.org/web/20121105034518/http://www.mandriva.com/en/support/security/advisories?name=MDVSA-2011:124

Url: http://www.exploit-db.com/exploits/17514

Url: http://www.openwall.com/lists/oss-security/2011/06/29/11

Url: https://github.com/phpmyadmin/phpmyadmin/commit/7ebd958b2bf59f96fecd5b3322bdbd0b244a7967

Url: http://www.exploit-db.com/exploits/17514/

Url: https://github.com/phpmyadmin/composer

Url: http://securityreason.com/securityalert/8306

Url: http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html

Url: http://www.openwall.com/lists/oss-security/2011/06/28/8

Url: https://web.archive.org/web/20110712103138/http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2011:124

Url: http://www.openwall.com/lists/oss-security/2011/06/28/6

Url: http://secunia.com/advisories/45139

Url: http://secunia.com/advisories/45315

Url: http://www.debian.org/security/2011/dsa-2286

Url: http://www.openwall.com/lists/oss-security/2011/06/28/2

Url: https://www.mend.io/vulnerability-database/CVE-2011-2505

Severity Score

6.5

Weakness Type (CWE)

Code Injection

CWE-94

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	6.4
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2011-2505

Date: July 14, 2011

Language: PHP

Severity Score

Related Resources (30)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?