CVE-2010-3055

The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.

• CWE-264

• http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2
• http://secunia.com/advisories/41058Vendor Advisory
• http://secunia.com/advisories/41185Vendor Advisory
• http://sourceforge.net/tracker/?func=detail&aid=3045132&group_id=23067&atid=377408Exploit
• http://www.debian.org/security/2010/dsa-2097
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:163
• http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/42591Patch
• http://www.vupen.com/english/advisories/2010/2223Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2231Vendor Advisory
• http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2
• http://secunia.com/advisories/41058Vendor Advisory
• http://secunia.com/advisories/41185Vendor Advisory
• http://sourceforge.net/tracker/?func=detail&aid=3045132&group_id=23067&atid=377408Exploit
• http://www.debian.org/security/2010/dsa-2097
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:163
• http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.phpPatch, Vendor Advisory
• http://www.securityfocus.com/bid/42591Patch
• http://www.vupen.com/english/advisories/2010/2223Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2231Vendor Advisory

Published

Aug 24, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3044Multiple buffer overflows in the Cisco WebEx Recording Forma…
• CVE-2010-3048Cisco Unified Personal Communicator 7.0 (1.13056) does not f…7.5
• CVE-2010-3049Cisco IOS before 12.2(33)SXI allows local users to cause a d…
• CVE-2010-3050Cisco IOS before 12.2(33)SXI allows remote authenticated use…
• CVE-2010-3053bdf/bdflib.c in FreeType before 2.4.2 allows remote attacker…
• CVE-2010-3054Unspecified vulnerability in FreeType 2.3.9, and other versi…
• CVE-2010-3056Multiple cross-site scripting (XSS) vulnerabilities in phpMy…
• CVE-2010-3058The Mount service in IBM Tivoli Storage Manager (TSM) FastBa…
• CVE-2010-3059Buffer overflow in the message-protocol implementation in th…
• CVE-2010-3060Unspecified vulnerability in the message-protocol implementa…
• CVE-2010-3061Unspecified vulnerability in the message-protocol implementa…
• CVE-2010-3062mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 t…