-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe key vulnerability stemmed from handling authentication parameters via $_REQUEST instead of $_POST. The commit 015c404 shows critical changes replacing $_REQUEST with $_POST for 'pma_username' and 'pma_password' parameters. This indicates the original code lacked proper CSRF protection by allowing GET-based authentication requests, which could be triggered via malicious image tags or forged URLs. The AuthenticationCookie::readCredentials method was directly responsible for this insecure parameter handling.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | < 4.9.0 | 4.9.0 |