-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.6, < 4.6.6 | 4.6.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in path handling. The commit 3b6ed1f modifies PMA_cleanupPathInfo to add query string handling and path normalization, addressing an incomplete fix from PMASA-2016-18. The original implementation failed to properly sanitize PHP_SELF by not stripping query parameters before processing PATH_INFO and not resolving '..'/. path components, enabling attackers to inject cookie attributes via manipulated URLs. The CWE-20 classification and patch context confirm input validation flaws in this function.
Ongoing coverage of React2Shell