-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.0, < 4.0.10.16 | 4.0.10.16 |
| phpmyadmin/phpmyadmin | composer | >= 4.4, < 4.4.15.7 | 4.4.15.7 |
| phpmyadmin/phpmyadmin | composer | >= 4.6, < 4.6.3 | 4.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from processing an unbounded array parameter in js/get_scripts.js.php. The patch adds array_slice(...,0,10) to limit iterations, indicating the original code lacked this restriction. The foreach loop over $_GET['scripts'] directly consumes user-controlled input without validation, enabling DoS via resource exhaustion (CWE-400). The file path and vulnerable pattern are explicitly shown in the commit diff and advisory descriptions.