UnratedFix available
phpmyadmin — security advisory
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
- Products
- phpmyadmin
- Affected versions
- Not specified
- Fixed versions
- 4:3.4.3.1-1
- CVEs
- CVE-2011-2506
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:35 UTC · Revision 1
Source evidence
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
osv:DEBIAN-CVE-2011-2506
phpmyadmin
Fixed versions: 4:3.4.3.1-1
phpmyadmin
Fixed versions: 4:3.4.3.1-1
phpmyadmin
Fixed versions: 4:3.4.3.1-1
Complete source record
{
"id": "36e2ee143e16e17ae29efd9c670024ddeaab92a33c5d2bded7812e4f85684bdf",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2011-2506",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2011-2506",
"summary": "setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.",
"evidence": "osv:DEBIAN-CVE-2011-2506",
"products": [
{
"name": {
"value": "phpmyadmin",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4:3.4.3.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "phpmyadmin",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4:3.4.3.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "phpmyadmin",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4:3.4.3.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2011-2506",
"aliases": [
"DEBIAN-CVE-2011-2506"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4:3.4.3.1-1"
}
]
}
],
"package": {
"name": "phpmyadmin",
"purl": "pkg:deb/debian/phpmyadmin?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-2506.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4:3.4.3.1-1"
}
]
}
],
"package": {
"name": "phpmyadmin",
"purl": "pkg:deb/debian/phpmyadmin?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-2506.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4:3.4.3.1-1"
}
]
}
],
"package": {
"name": "phpmyadmin",
"purl": "pkg:deb/debian/phpmyadmin?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-2506.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T17:47:47.755072416Z",
"provider": "osv",
"upstream": [
"CVE-2011-2506"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2011-2506"
]
},
"related_cves": [
{
"value": "CVE-2011-2506",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 418984,
"published_at": "2011-07-14T23:55:04.88+00:00"
}