scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v0 parameters which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.