phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

Etkilenen sürümler1 yazılım

Kaynaklar10 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3 Yama
• github.com/…ommit/126ac3ac5662ed3171ef3646636348fad3f8e952 Yama
• github.com/phpmyadmin/phpmyadmin/pull/19156 Yama
• abraxaslabs.tech/research/phpmyadmin-setup-validate Üçüncü taraf
• vulncheck.com/…rf-via-setup-validate-php-after-setup-disabled Üçüncü taraf
• github.com/…pmyadmin/blob/RELEASE_5_2_3/setup/validate.php Diğer
• github.com/…E_5_2_3/libraries/classes/Config/Validator.php Diğer
• github.com/phpmyadmin/phpmyadmin Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:30Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-119563phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
• 4,2 CVE-2026-119562phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
• 6,8 CVE-2026-119561phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
• 4,3 CVE-2026-119429phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
• 4,2 CVE-2026-119427phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
• 7,5 CVE-2026-119426phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql