| Título | phpMyAdmin SQL-Parser 6.0.0 CWE-704: Incorrect Type Conversion or Cast |
|---|
| Descrição | phpmyadmin/sql-parser 6.0.0 is vulnerable to an uncaught TypeError in src/Statements/ExplainStatement.php around line 164. The property ExplainStatement::$connectionId is declared as int|null, but parse() assigns $nextToken->value without validating the token type. For certain valid MySQL EXPLAIN FOR CONNECTION forms, the token is a Delimiter or Operator token whose value is a string. Because the file uses declare(strict_types=1);, PHP rejects the assignment with:
Cannot assign string to property PhpMyAdmin\SqlParser\Statements\ExplainStatement::$connectionId of type ?int
The exception escapes the parser constructor and terminates the process before $parser->errors can be populated. This makes it unrecoverable for callers that follow the library API by checking count($parser->errors).
Triggering inputs include:
EXPLAIN FOR CONNECTION;
EXPLAIN FOR CONNECTION (EOF)
EXPLAIN FOR CONNECTION (42);
The parenthesised form EXPLAIN FOR CONNECTION (42); is syntactically valid but reaches the same assignment with an opening parenthesis token instead of a number, causing the same crash. A 12-input sweep confirmed 3 crashing inputs, all through the same FOR CONNECTION code path.
Impact: Denial of Service. A single line of valid SQL kills the calling PHP process. If an application passes untrusted SQL to new Parser(...), the issue is remotely reachable without authentication. No memory corruption, privilege escalation, or code execution was demonstrated.
CVSS:3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS score: 7.5 High
Suggested fix: before assignment, verify the token is TokenType::Number and cast to int; otherwise record a parser error and break. A patch is included in the public advisory. |
|---|
| Fonte | ⚠️ https://gist.github.com/Ishanoshada/f984e2f5f31e02a42d98615348cfca51 |
|---|
| Utilizador | ishanoshada (UID 101910) |
|---|
| Submissão | 07/10/2026 14h28 (há 27 dias) |
|---|
| Moderação | 03/11/2026 11h48 (27 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 430228 [phpMyAdmin SQL-Parser 6.0.0/6.0.1 ExplainStatement.php parse nextToken Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|