-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 3.5, < 3.5.3 | 3.5.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: (1) insecure fetching of JavaScript via HTTP using $.getScript, and (2) improper handling of the fetched data. The function PMA_current_version is explicitly vulnerable because it directly consumed the untrusted data (e.g., PMA_latest_version) without escaping, as evidenced by the fix in commit a547f3d, which added HTML escaping to the data. While the $.getScript call enabled the MITM vector, the XSS exploitation occurs in PMA_current_version due to lack of output sanitization.
A Semantic Attack on Google Gemini - Read the Latest Research