6.5

CVE-2011-2507

Exploit

libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Phpmyadmin ≫ Phpmyadmin Version3.0.0
Phpmyadmin ≫ Phpmyadmin Version3.0.0 Updatealpha
Phpmyadmin ≫ Phpmyadmin Version3.0.0 Updatebeta
Phpmyadmin ≫ Phpmyadmin Version3.0.0 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.0.1
Phpmyadmin ≫ Phpmyadmin Version3.0.1 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.0.1.1
Phpmyadmin ≫ Phpmyadmin Version3.1.0
Phpmyadmin ≫ Phpmyadmin Version3.1.0 Updatebeta1
Phpmyadmin ≫ Phpmyadmin Version3.1.1
Phpmyadmin ≫ Phpmyadmin Version3.1.1 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.1.2
Phpmyadmin ≫ Phpmyadmin Version3.1.2 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.1.3
Phpmyadmin ≫ Phpmyadmin Version3.1.3 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.1.3.1
Phpmyadmin ≫ Phpmyadmin Version3.1.3.2
Phpmyadmin ≫ Phpmyadmin Version3.1.4
Phpmyadmin ≫ Phpmyadmin Version3.1.4 Updaterc2
Phpmyadmin ≫ Phpmyadmin Version3.1.5
Phpmyadmin ≫ Phpmyadmin Version3.1.5 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.2.0
Phpmyadmin ≫ Phpmyadmin Version3.2.0 Updatebeta1
Phpmyadmin ≫ Phpmyadmin Version3.2.0 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.2.1
Phpmyadmin ≫ Phpmyadmin Version3.2.1 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.2.2
Phpmyadmin ≫ Phpmyadmin Version3.2.2 Updaterc1
Phpmyadmin ≫ Phpmyadmin Version3.3.0.0
Phpmyadmin ≫ Phpmyadmin Version3.3.1.0
Phpmyadmin ≫ Phpmyadmin Version3.3.2.0
Phpmyadmin ≫ Phpmyadmin Version3.3.3.0
Phpmyadmin ≫ Phpmyadmin Version3.3.4.0
Phpmyadmin ≫ Phpmyadmin Version3.3.5.0
Phpmyadmin ≫ Phpmyadmin Version3.3.5.1
Phpmyadmin ≫ Phpmyadmin Version3.3.6
Phpmyadmin ≫ Phpmyadmin Version3.3.7
Phpmyadmin ≫ Phpmyadmin Version3.3.8
Phpmyadmin ≫ Phpmyadmin Version3.3.8.1
Phpmyadmin ≫ Phpmyadmin Version3.3.9.0
Phpmyadmin ≫ Phpmyadmin Version3.3.9.1
Phpmyadmin ≫ Phpmyadmin Version3.3.9.2
Phpmyadmin ≫ Phpmyadmin Version3.3.10.0
Phpmyadmin ≫ Phpmyadmin Version3.3.10.1
Phpmyadmin ≫ Phpmyadmin Version3.4.0.0
Phpmyadmin ≫ Phpmyadmin Version3.4.1.0
Phpmyadmin ≫ Phpmyadmin Version3.4.2.0
Phpmyadmin ≫ Phpmyadmin Version3.4.3.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.74% 0.869
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.