Adminneo
Monthly
AdminNeo's unauthenticated `?script=version` endpoint accepts POST data with no origin, CSRF or parameter-type validation, so a remote client can submit `version[]=...` and have PHP turn the expected string into an array. From 4.6.2 up to but not including 5.5.0, that array is serialized into the shared `adminneo.version` cache and later fed to `cookie()` and `rawurlencode()`, which throws a `TypeError` and returns HTTP 500 to every user of the instance. No credentials or user interaction are required, but exploitation depends on the web server being able to write the cache file and on version verification being enabled; the outage self-clears after the cache's 24-hour lifetime or immediately when the poisoned file is deleted. No confirmed public exploit code or active exploitation is identified at time of analysis, though the advisory does publish step-by-step reproduction commands.
AdminNeo's unauthenticated `?script=version` endpoint accepts POST data with no origin, CSRF or parameter-type validation, so a remote client can submit `version[]=...` and have PHP turn the expected string into an array. From 4.6.2 up to but not including 5.5.0, that array is serialized into the shared `adminneo.version` cache and later fed to `cookie()` and `rawurlencode()`, which throws a `TypeError` and returns HTTP 500 to every user of the instance. No credentials or user interaction are required, but exploitation depends on the web server being able to write the cache file and on version verification being enabled; the outage self-clears after the cache's 24-hour lifetime or immediately when the poisoned file is deleted. No confirmed public exploit code or active exploitation is identified at time of analysis, though the advisory does publish step-by-step reproduction commands.