CVE-2011-2719
Description
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
51cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*+ 50 more
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*
- (no CPE)range: <3.3.10.3 and <3.4.3.2
Patches
Vulnerability mechanics
Root cause
"Missing input validation of the user-provided query string in the Swekey authentication module allows manipulation of PHP superglobal arrays and local variables."
Attack vector
A remote attacker sends a crafted query string to the Swekey authentication module while the Swekey extension is enabled [ref_id=1][ref_id=2]. The module fails to properly sanitize the query string, allowing the attacker to manipulate the PHP `$_SESSION` superglobal array, other superglobal arrays, and local variables within `swekey.auth.lib.php` [ref_id=1][CWE-20]. No authentication is required to trigger the manipulation, as the flaw exists in the authentication module itself [ref_id=2].
Affected code
The vulnerable file is `libraries/auth/swekey/swekey.auth.lib.php` in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 [ref_id=1][ref_id=2]. The flaw occurs in the Swekey authentication module's handling of the user-supplied query string.
What the fix does
The fix is included in phpMyAdmin versions 3.3.10.3 and 3.4.3.2 [ref_id=1][ref_id=3]. Patches are available via the upstream git repository for both the 3.3 and 3.4 branches [ref_id=2]. The patches add proper sanitization of the user-provided query string in the Swekey authentication module, preventing manipulation of superglobal arrays and local variables [ref_id=1][CWE-20].
Preconditions
- configThe Swekey authentication extension must be enabled in phpMyAdmin
- networkAttacker must be able to send HTTP requests to the phpMyAdmin instance
- authNo prior authentication is required
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
21- www.openwall.com/lists/oss-security/2011/07/25/4nvdPatch
- www.openwall.com/lists/oss-security/2011/07/26/10nvdPatch
- www.phpmyadmin.net/home_page/security/PMASA-2011-12.phpnvdPatchVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdPatch
- secunia.com/advisories/45365nvdVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.htmlnvd
- osvdb.org/74112nvd
- phpmyadmin.git.sourceforge.net/git/gitweb.cginvd
- phpmyadmin.git.sourceforge.net/git/gitweb.cginvd
- seclists.org/fulldisclosure/2011/Jul/300nvd
- secunia.com/advisories/45315nvd
- secunia.com/advisories/45515nvd
- securityreason.com/securityalert/8322nvd
- www.debian.org/security/2011/dsa-2286nvd
- www.mandriva.com/security/advisoriesnvd
- www.securityfocus.com/archive/1/518967/100/0/threadednvd
- www.securityfocus.com/archive/1/519155/100/0/threadednvd
- www.securityfocus.com/bid/48874nvd
- www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txtnvd
- exchange.xforce.ibmcloud.com/vulnerabilities/68769nvd
News mentions
0No linked articles in our index yet.