CVE-2011-4107

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N

EPSS

12.67% chance of exploitation in the next 30 days, 96th percentile

Published

2011-11-17

Updated

2024-08-07

Proof-of-concept exploits (2)

• https://bugzilla.redhat.com/show_bug.cgi?id=751112
• SECFORCE/CVE-2011-41074★ · 2017-04-19

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/18371

References

• CVE Record
• NVD entry

Related

• CVE-2008-1613
• CVE-2008-5416
• CVE-2011-3368
• CVE-2017-3599
• CVE-2018-8941
• CVE-2020-28647