-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how ConfigGenerator.class.php builds server configuration comments. The pre-patch code used strtr($cf->getServerName($id), '/', '-') but failed to sanitize the $id parameter appended in the comment. Attackers leveraging compromised session variables could craft a server ID like '/ {malicious_code} /', breaking out of the comment context. The commit 0fbedaf explicitly fixes this by sanitizing both server name and ID together via strtr($cf->getServerName($id)." [$id] ", '/', '-'), confirming this was the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 3.0, < 3.3.10.2 | 3.3.10.2 |
| phpmyadmin/phpmyadmin | composer | >= 3.4, < 3.4.3.1 | 3.4.3.1 |