The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL query by creating a bookmark.

According to its self-identified version number, the phpMyAdmin install hosted on the remote web server allows creation of bookmarked SQL queries which could be unintentionally executed by other users. 

Note that successful exploitation of this vulnerability requires that phpMyAdmin configuration storage is set up and enabled and that the application's bookmarks feature is enabled.

The remote host is affected by the vulnerability described in GLSA-201201-01 (phpMyAdmin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in phpMyAdmin. Please       review the CVE identifiers and phpMyAdmin Security Advisories referenced       below for details.
  Impact :

    Remote attackers might be able to insert and execute PHP code, include       and execute local PHP files, or perform Cross-Site Scripting (XSS)       attacks via various vectors.
  Workaround :

    There is no known workaround at this time.

Changes for 3.3.9.1 (2011-02-08)

  - [security] Path disclosure, see PMASA-2011-1

    -       http://www.phpmyadmin.net/home_page/security/PMASA-201       1-1.php

Changes for 3.3.9.2 (2011-02-11)

  - [security] SQL injection, see PMASA-2011-2

    -       http://www.phpmyadmin.net/home_page/security/PMASA-201       1-2.php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that phpMyAdmin, a tool to administer MySQL over the web, when the bookmarks feature is enabled, allowed to create a bookmarked query which would be executed unintentionally by other users.

Versions of phpMyAdmin earlier than 2.11.11.3 / 3.3.9.2 are potentially affected by a SQL-injection vulnerability, because the application makes it possible to create a bookmark which would be executed unintentionally by other users.

ID	Name	Product	Family	Severity
59244	phpMyAdmin 2.11.x / 3.3.x < 2.11.11.3 / 3.3.9.2 SQL Query Bookmarks Arbitrary SQL Query Execution (PMASA-2011-02)	Nessus	CGI abuses	medium
57433	GLSA-201201-01 : phpMyAdmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
52514	Fedora 15 : phpMyAdmin-3.3.9.2-1.fc15 (2011-1282)	Nessus	Fedora Local Security Checks	medium
52465	Fedora 14 : phpMyAdmin-3.3.9.2-1.fc14 (2011-1408)	Nessus	Fedora Local Security Checks	medium
52464	Fedora 13 : phpMyAdmin-3.3.9.2-1.fc13 (2011-1373)	Nessus	Fedora Local Security Checks	medium
52030	Debian DSA-2167-1 : phpmyadmin - SQL injection	Nessus	Debian Local Security Checks	medium
5797	phpMyAdmin 2.x < 2.11.11.3 / 3.x < 3.3.9.2 SQLi (PMASA-2011-2)	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2011-0987

high

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium