-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.0, < 4.0.10.16 | 4.0.10.16 |
| phpmyadmin/phpmyadmin | composer | >= 4.4, < 4.4.15.7 | 4.4.15.7 |
| phpmyadmin/phpmyadmin | composer | >= 4.6, < 4.6.3 | 4.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from unhandled exceptions when constructing the OpenID_Message object in examples/openid.php. Before the patch, the code did not catch exceptions thrown during the creation of OpenID_Message, leading to PHP's default error handling. If the server had html_errors disabled, unescaped error messages containing user-controlled input (from $queryString) could be displayed, enabling XSS. However, the vulnerability is not tied to a specific function in phpMyAdmin's code but rather to the procedural flow lacking proper exception handling. The existing error handlers in catch blocks used htmlspecialchars correctly, but the uncaught exception path in the main script was the root issue. Thus, no specific functions in phpMyAdmin's code are identified as vulnerable with high confidence.
PHPPHPOngoing coverage of React2Shell