CVE-2011-4107
Medium · 6.5CVSS
6.5
EPSS
12.7%
Published
Nov 17, 2011
CISA due date
—
The record
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | 3.3.0 | 3.3.10.5 |
| Packagist | phpmyadmin/phpmyadmin | 3.4.0 | 3.4.7.1 |
| Debian:11 | phpmyadmin | 0 | 4:3.4.7.1-1 |
| Debian:12 | phpmyadmin | 0 | 4:3.4.7.1-1 |
| Debian:13 | phpmyadmin | 0 | 4:3.4.7.1-1 |
| Debian:6.0 | phpmyadmin | 0 | 4:3.3.7-7 |
| openSUSE:Tumbleweed | phpMyAdmin | 0 | 4.6.5.2-1.1 |
| packagist | phpmyadmin/phpmyadmin | 3.3.0 | No fix |
| packagist | phpmyadmin/phpmyadmin | 3.4.0 | No fix |
Related vulnerabilities
- CVE-2025-24530 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin/phpmyadmin
- CVE-2016-5734 phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not… Also affects phpmyadmin/phpmyadmin
- CVE-2015-6830 libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2… Also affects phpmyadmin/phpmyadmin
- CVE-2011-2505 libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in… Also affects phpmyadmin/phpmyadmin
- CVE-2025-24529 An issue was discovered in phpMyAdmin 5.x before 5.2.2. Also affects phpmyadmin
- CVE-2014-9218 libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and… Also affects phpmyadmin
- CVE-2010-3055 The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before… Also affects phpmyadmin
- CVE-2009-1285 Static code injection vulnerability in the getConfigFile function in… Also affects phpmyadmin