Threats tagged 'ghsa-7gqf-2rj6-2m6m'

phpMyAdmin versions up to 5.2.3 have a server-side request forgery (SSRF) vulnerability in setup/validate.php. This flaw allows unauthenticated attackers to make outbound connections by sending crafted POST requests with attacker-controlled host and port values. The vulnerability arises because the setup-disabled guard is missing, enabling attackers to trigger MySQL-protocol connections and probe internal ports through error messages.