CVE-2011-2507

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2011-07-14 · updated 2026-06-16
Weakness: CWE-94

Description

libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.

Affected products

phpMyAdmin: 3.0.0, 3.0.0-alpha, 3.0.0-beta, 3.0.0-rc1, 3.0.1, 3.0.1-rc1 (+42)

References

http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html
http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html
http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=69fb0f8e7dc38075427aceaf09bcac697d0590ff
http://secunia.com/advisories/45139
http://secunia.com/advisories/45292
http://secunia.com/advisories/45315
http://securityreason.com/securityalert/8306
http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/
http://www.debian.org/security/2011/dsa-2286
http://www.mandriva.com/security/advisories?name=MDVSA-2011:124

Get alerted when CVE-2011-2507 or the next vulnerability affects your stack