-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves reflected file download (RFD) via malicious SVG filenames. RFD attacks typically occur when user-controlled input is directly used in Content-Disposition headers without proper sanitization. The phpMyAdmin security advisory (PMASA-2016-51) references commits that patched filename handling in export functionality. The export mechanism (handled by PMA_exportOutputHandler in export.lib.php) would be the logical location where filenames are constructed from user input. The vulnerability was fixed by validating/sanitizing filenames in these export handlers, confirming this function's role in the exploit chain.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.6, < 4.6.4 | 4.6.4 |
| phpmyadmin/phpmyadmin | composer | >= 4.4, < 4.4.15.8 | 4.4.15.8 |
| phpmyadmin/phpmyadmin | composer | >= 4.0, < 4.0.10.17 | 4.0.10.17 |
PHPPHP