CVE-2011-2506
phpMyAdmin 3.x < 3.3.10.2 and 3.4.x < 3.4.3.1 - Remote Code Injection via SESSION Superglobal
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-2506. PoCs published by Mango, wofeiwo.
AI-analyzed exploit summary This exploit targets a remote code injection vulnerability in phpMyAdmin versions < 3.3.10.2 and < 3.4.3.1. It leverages session poisoning and file saving to inject arbitrary PHP code into the configuration file, achieving remote code execution.
Description
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
Exploits (2)
This exploit targets a remote code injection vulnerability in phpMyAdmin versions < 3.3.10.2 and < 3.4.3.1. It leverages session poisoning and file saving to inject arbitrary PHP code into the configuration file, achieving remote code execution.
This exploit targets a PHP session variable manipulation vulnerability in phpMyAdmin versions below 3.3.10.2 and 3.4.3.1, allowing remote code execution by injecting malicious payloads into session variables and leveraging the setup script to write a webshell.