AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated "?script=version" endpoint accepts POST data without origin, CSRF or parameter-type validation. A "version[]" parameter becomes a PHP array that "bootstrap.inc.php" serializes into the shared "adminneo.version" cache. On later page loads, "design.inc.php" passes that cached value to "cookie()" and "rawurlencode()", causing a "TypeError" rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.