Sql Parser
Monthly
Incorrect type conversion in phpMyAdmin SQL-Parser 6.0.0 and 6.0.1 allows remote attackers to degrade availability when attacker-controlled SQL containing an EXPLAIN statement reaches ExplainStatement::parse with a manipulated nextToken argument. Only applications embedding these two library versions and passing untrusted SQL into the parser are exposed; the parser itself imposes no authentication requirement, but exploitability depends entirely on whether the consuming application parses untrusted input. A public PoC reference (a GitHub gist) has been published but is not verified as working exploit code, and the vendor did not respond to the disclosure; impact is limited to availability with no confidentiality or integrity effect.
Incorrect type conversion in phpMyAdmin SQL-Parser 6.0.0 and 6.0.1 allows remote attackers to degrade availability when attacker-controlled SQL containing an EXPLAIN statement reaches ExplainStatement::parse with a manipulated nextToken argument. Only applications embedding these two library versions and passing untrusted SQL into the parser are exposed; the parser itself imposes no authentication requirement, but exploitability depends entirely on whether the consuming application parses untrusted input. A public PoC reference (a GitHub gist) has been published but is not verified as working exploit code, and the vendor did not respond to the disclosure; impact is limited to availability with no confidentiality or integrity effect.