Shapefile
Monthly
An infinite loop in the ShapeRecord::loadFromFile parser of phpMyAdmin ShapeFile (versions up to and including 4.0.1) allows remote attackers to stall or hang the importing process by supplying a crafted ESRI .shp file, consuming CPU until the process is killed or times out. No authentication is required, but the crafted shapefile must actually be fed into the SHP import/parse path for the condition to fire, so exposure is limited to deployments that accept externally supplied shapefiles. Impact is confined to availability (VA:L) with no confidentiality or integrity effect; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
An infinite loop in the ShapeRecord::loadFromFile parser of phpMyAdmin ShapeFile (versions up to and including 4.0.1) allows remote attackers to stall or hang the importing process by supplying a crafted ESRI .shp file, consuming CPU until the process is killed or times out. No authentication is required, but the crafted shapefile must actually be fed into the SHP import/parse path for the condition to fire, so exposure is limited to deployments that accept externally supplied shapefiles. Impact is confined to availability (VA:L) with no confidentiality or integrity effect; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).