VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 14, 2011· Updated Apr 29, 2026

CVE-2011-2505

CVE-2011-2505

Description

phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 allows remote attackers to manipulate the $_SESSION superglobal via a crafted query string due to unsafe use of parse_str in the Swekey authentication feature.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 allows remote attackers to manipulate the $_SESSION superglobal via a crafted query string due to unsafe use of parse_str in the Swekey authentication feature.

Vulnerability

The vulnerability resides in libraries/auth/swekey/swekey.auth.lib.php at lines 266–276 of phpMyAdmin 3.x versions prior to 3.3.10.2 and 3.4.x prior to 3.4.3.1 [1][2]. The code calls parse_str($_SERVER['QUERY_STRING']) without a second argument, causing every parameter and value in the query string to be assigned as variables in the current namespace. This code path is reachable when the query string contains session_to_unset [2].

Exploitation

An attacker can send a crafted HTTP request containing arbitrary parameters (e.g., session_to_unset, session_id, and any desired $_SESSION keys) to the vulnerable phpMyAdmin instance. No authentication is required. The parse_str call sets the attacker-supplied variables, and the subsequent session_write_close() saves the modified session before session_destroy() is called. Because the session is written before destruction, the attacker-controlled values persist in the session store [2].

Impact

Successful exploitation allows the attacker to arbitrarily set values in the $_SESSION superglobal. This can lead to privilege escalation, cross-site scripting (XSS), SQL injection, or remote code execution when combined with other vulnerabilities (such as CVE-2011-2506) [1][2]. The attacker effectively gains control over session data, which may bypass authentication and authorization checks.

Mitigation

The issue is fixed in phpMyAdmin versions 3.3.10.2 and 3.4.3.1, released on 2011-07-09 [1][2]. Users should upgrade to these or later versions. No workaround is documented. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog.

References
  1. NVD - CVE-2011-2505
  2. phpMyAdmin 3.x Multiple Remote Code Executions

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
phpmyadmin/phpmyadminPackagist
>= 3.0, < 3.3.10.23.3.10.2
phpmyadmin/phpmyadminPackagist
>= 3.4, < 3.4.3.13.4.3.1

Affected products

50
  • PhpMyAdmin/phpMyAdmin49 versions
    cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*+ 48 more
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*
    • (no CPE)range: >=3.0, <3.3.10.2 || >=3.4.0, <3.4.3.1
  • ghsa-coords
    pkg:composer/phpmyadmin/phpmyadmin
    Range: >= 3.0, < 3.3.10.2

Patches

3
7ebd958b2bf5

Fixed possible session manipulation in swekey authentication, see PMASA-2011-5

https://github.com/phpmyadmin/composerHerman van RinkJun 30, 2011via ghsa
commit
2 files changed · +5 −3
  • ChangeLog+3 −0 modified
    @@ -1,6 +1,9 @@
 phpMyAdmin - ChangeLog
 ======================
 
+3.4.3.1 (not yet released)
+- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5
+
 3.4.3.0 (2011-06-27)
 - bug #3311170 [sync] Missing helper icons in Synchronize
 - patch #3304473 [setup] Redefine a lable that was wrong
  • libraries/auth/swekey/swekey.auth.lib.php+2 −3 modified
    @@ -263,11 +263,10 @@ function open_swekey_site()
 	}
 }
 
-if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false)
+if (!empty($_GET['session_to_unset']))
 {
-    parse_str($_SERVER['QUERY_STRING']);
 	session_write_close();
-	session_id($session_to_unset);
+	session_id($_GET['session_to_unset']);
 	session_start();
 	$_SESSION = array();
 	session_write_close();
7ebd958b2bf5

Fixed possible session manipulation in swekey authentication, see PMASA-2011-5

https://github.com/phpmyadmin/phpmyadminHerman van RinkJun 30, 2011via ghsa
commit
2 files changed · +5 −3
  • ChangeLog+3 −0 modified
    @@ -1,6 +1,9 @@
 phpMyAdmin - ChangeLog
 ======================
 
+3.4.3.1 (not yet released)
+- [security] Fixed possible session manipulation in swekey authentication, see PMASA-2011-5
+
 3.4.3.0 (2011-06-27)
 - bug #3311170 [sync] Missing helper icons in Synchronize
 - patch #3304473 [setup] Redefine a lable that was wrong
  • libraries/auth/swekey/swekey.auth.lib.php+2 −3 modified
    @@ -263,11 +263,10 @@ function open_swekey_site()
 	}
 }
 
-if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false)
+if (!empty($_GET['session_to_unset']))
 {
-    parse_str($_SERVER['QUERY_STRING']);
 	session_write_close();
-	session_id($session_to_unset);
+	session_id($_GET['session_to_unset']);
 	session_start();
 	$_SESSION = array();
 	session_write_close();
6e6e129f2629

Fixed possible session corruption in swekey authentication

https://github.com/phpmyadmin/phpmyadminHerman van RinkJun 29, 2011via ghsa
commit
2 files changed · +5 −3
  • ChangeLog+3 −0 modified
    @@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog
 $Id$
 $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $
 
+3.3.10.2 (not yet released)
+- [security] Fixed possible session corruption in swekey authentication
+
 3.3.10.1 (2011-05-20)
 - [security] XSS on Tracking page
  • libraries/auth/swekey/swekey.auth.lib.php+2 −3 modified
    @@ -263,11 +263,10 @@ function open_swekey_site()
 	}
 }
 
-if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false)
+if (!empty($_GET['session_to_unset']))
 {
-    parse_str($_SERVER['QUERY_STRING']);
 	session_write_close();
-	session_id($session_to_unset);
+	session_id($_GET['session_to_unset']);
 	session_start();
 	$_SESSION = array();
 	session_write_close();

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

29

News mentions

0

No linked articles in our index yet.