CVE-2011-2505
NoneCVSS
—
EPSS
12.9%
Published
Jul 14, 2011
CISA due date
—
The record
libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 3.0 | 3.3.10.2 |
| Packagist | phpmyadmin/phpmyadmin | 3.4 | 3.4.3.1 |
| Debian:11 | phpmyadmin | 0 | 4:3.4.3.1-1 |
| Debian:12 | phpmyadmin | 0 | 4:3.4.3.1-1 |
| Debian:13 | phpmyadmin | 0 | 4:3.4.3.1-1 |
| Debian:5.0 | phpmyadmin | 0 | 4:2.11.8.1-5+lenny9 |
| Debian:6.0 | phpmyadmin | 0 | 4:3.3.7-6 |
| packagist | phpmyadmin/phpmyadmin | 3.0 | No fix |
| packagist | phpmyadmin/phpmyadmin | 3.4 | No fix |
Related vulnerabilities
- CVE-2025-24530 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin/phpmyadmin
- CVE-2016-5734 phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not… Also affects phpmyadmin/phpmyadmin
- CVE-2015-6830 libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2… Also affects phpmyadmin/phpmyadmin
- CVE-2011-4107 The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php)… Also affects phpmyadmin/phpmyadmin
- CVE-2025-24529 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin
- CVE-2014-9218 libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and… Also affects phpmyadmin
- CVE-2010-3055 The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before… Also affects phpmyadmin
- CVE-2009-1285 Static code injection vulnerability in the getConfigFile function in… Also affects phpmyadmin