CVE-2010-3055
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does...
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
Exploit likelihood
What each source reports
NVD Score used
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
- Record
CVE-2010-3055- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
- Record
CVE-2010-3055- Updated
- 2026-11-02
EUVDEUVD-2010-3057 No score
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
- Record
EUVD-2010-3057- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6442-8w69-mgwm No score
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does...
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
- Record
GHSA-6442-8w69-mgwm- Updated
- 2026-11-02
OSV No score
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
- Record
CVE-2010-3055- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-3055 No score
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
- Record
DEBIAN-CVE-2010-3055- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadminDebian:12 |
before 4:3.0.0 | 4:3.0.0 |
phpmyadminDebian:13 |
before 4:3.0.0 | 4:3.0.0 |
phpmyadminDebian:14 |
before 4:3.0.0 | 4:3.0.0 |
phpmyadminDebian:5.0 From an advisory covering 2 CVEs |
before 4:2.11.8.1-5+lenny5, plus listed versions 4:2.11.8.1-54:2.11.8.1-5+lenny14:2.11.8.1-5+lenny34:2.11.8.1-5+lenny4 |
4:2.11.8.1-5+lenny5 |
phpmyadminDebian:5.0 From an advisory covering 2 CVEs |
before 4:2.11.8.1-5+lenny6, plus listed versions 4:2.11.8.1-54:2.11.8.1-5+lenny14:2.11.8.1-5+lenny34:2.11.8.1-5+lenny44:2.11.8.1-5+lenny5 |
4:2.11.8.1-5+lenny6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3055 is a high vulnerability (CVSS 7.5) in Phpmyadmin, published August 24, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.8%, the 96th percentile. Fixed in phpmyadmin 4:3.0.0.
References
securityfocus.com/bid/42591
phpmyadmin.net/home_page/security/PMASA-2010-4.php
secunia.com/advisories/41058
sourceforge.net/tracker?func=detail&aid=3045132&group_id=23067&atid=377408
vupen.com/english/advisories/2010/2231
debian.org/security/2010/dsa-2097
Show 8 moreShow less
mandriva.com/security/advisories?name=MDVSA-2010:163
phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2
nvd.nist.gov/vuln/detail/CVE-2010-3055
github.com/advisories/GHSA-6442-8w69-mgwm
security-tracker.debian.org/tracker/CVE-2010-3055