-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from the lack of CSRF protections in the server removal logic. In the vulnerable version (<=4.9.0.1), the code in setup/frames/servers.inc.php processed 'mode=remove' requests without validating the HTTP method (GET vs. POST) or checking a CSRF token. The fix in commit 427fbed added a POST method check and CSRF token validation. The absence of these protections in the original code allowed attackers to forge malicious GET requests (e.g., via an <img> tag) to delete servers. The file and logic are explicitly identified in the commit diff and CVE description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | <= 4.9.0.1 | 4.9.1 |
Ongoing coverage of React2Shell