CVE-2011-2506
phpMyAdmin vulnerable to static code injection
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
Exploit likelihood
What each source reports
NVD Score used
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
CVE-2011-2506- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
CVE-2011-2506- Updated
- 2026-11-02
EUVDEUVD-2022-4696 No score
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
EUVD-2022-4696- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6h7-29r2-g88f No score
phpMyAdmin vulnerable to static code injection
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
GHSA-p6h7-29r2-g88f- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
CVE-2011-2506- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2506 No score
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
DEBIAN-CVE-2011-2506- Updated
- 2026-11-02
OSVGHSA-p6h7-29r2-g88f No score
phpMyAdmin vulnerable to static code injection
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Record
GHSA-p6h7-29r2-g88f- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
3.0 up to 3.3.10.2 | 3.3.10.2 |
phpmyadmin/phpmyadminPackagist |
3.4 up to 3.4.3.1 | 3.4.3.1 |
phpmyadminDebian:12 |
before 4:3.4.3.1-1 | 4:3.4.3.1-1 |
phpmyadminDebian:13 |
before 4:3.4.3.1-1 | 4:3.4.3.1-1 |
phpmyadminDebian:14 |
before 4:3.4.3.1-1 | 4:3.4.3.1-1 |
phpmyadminDebian:6.0 From an advisory covering 6 CVEs |
before 4:3.3.7-6, plus listed versions 4:3.3.7-34:3.3.7-5 |
4:3.3.7-6 |
phpmyadminDebian:5.0 From an advisory covering 6 CVEs |
before 4:2.11.8.1-5+lenny9, plus listed versions 4:2.11.8.1-54:2.11.8.1-5+lenny14:2.11.8.1-5+lenny34:2.11.8.1-5+lenny44:2.11.8.1-5+lenny54:2.11.8.1-5+lenny64:2.11.8.1-5+lenny74:2.11.8.1-5+lenny8 |
4:2.11.8.1-5+lenny9 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | phpMyAdmin3 (pma3) - Remote Code Execution | 2011-07-08 |
| Exploit-DB | phpMyAdmin 3.x - Swekey Remote Code Injection | 2011-07-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2506 is a high vulnerability (CVSS 7.5) in Phpmyadmin, published July 14, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.63%, the 95th percentile. Fixed in phpmyadmin/phpmyadmin 3.3.10.2.
References
xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
openwall.com/lists/oss-security/2011/06/28/2
typo3.org/teams/security/security-bulletins/typo3-sa-2011-008
phpmyadmin.net/home_page/security/PMASA-2011-6.php
secunia.com/advisories/45292
Show 23 moreShow less
mandriva.com/security/advisories?name=MDVSA-2011:124
securityreason.com/securityalert/8306
phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f
exploit-db.com/exploits/17514
debian.org/security/2011/dsa-2286
securityfocus.com/archive/1/518804/100/0/threaded
osvdb.org/73612
ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
nvd.nist.gov/vuln/detail/CVE-2011-2506
github.com/phpmyadmin/phpmyadmin/commit/0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f
web.archive.org/web/20110712103138/http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
security-tracker.debian.org/tracker/CVE-2011-2506