Description
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
Remediation
References
Related Vulnerabilities
Joomla! Core 3.x.x Security Bypass (3.0.0 - 3.9.19)
WordPress Plugin WooCommerce Email Test Information Disclosure (1.5)
PHP Use After Free Vulnerability (CVE-2017-12932)
phpMyAdmin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-1149)
WordPress Plugin Ad Inserter-Ad Manager & AdSense Ads Remote Code Execution (2.4.21)