Evil-DB LogoEvil-DB
← All CVEs

CVE-2010-3055

high · 7.5

The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.

7.5
CVSS
14.8%
EPSS (exploit prob.)
97th
EPSS percentile
2010-08-24
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-264

Affected products

VendorProductAffected versions
phpmyadminphpmyadmin2.11.0
phpmyadminphpmyadmin2.11.1.0
phpmyadminphpmyadmin2.11.1.1
phpmyadminphpmyadmin2.11.1.2
phpmyadminphpmyadmin2.11.2.0
phpmyadminphpmyadmin2.11.2.1
phpmyadminphpmyadmin2.11.2.2
phpmyadminphpmyadmin2.11.3.0
phpmyadminphpmyadmin2.11.4.0
phpmyadminphpmyadmin2.11.5.0
phpmyadminphpmyadmin2.11.5.1
phpmyadminphpmyadmin2.11.5.2
phpmyadminphpmyadmin2.11.6.0
phpmyadminphpmyadmin2.11.7.0
phpmyadminphpmyadmin2.11.7.1
phpmyadminphpmyadmin2.11.8.0
phpmyadminphpmyadmin2.11.9.0
phpmyadminphpmyadmin2.11.9.1
phpmyadminphpmyadmin2.11.9.2
phpmyadminphpmyadmin2.11.9.3
phpmyadminphpmyadmin2.11.9.4
phpmyadminphpmyadmin2.11.9.5
phpmyadminphpmyadmin2.11.9.6
phpmyadminphpmyadmin2.11.10.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2010-3055