libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Nov 2023, 02:07
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2011-07-14 23:55
Updated : 2024-02-28 11:41
NVD link : CVE-2011-2507
Mitre link : CVE-2011-2507
CVE.ORG link : CVE-2011-2507
JSON object : View
Products Affected
phpmyadmin
- phpmyadmin
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')