AdminNeo CVE-2026-96634
MEDIUM
GHSA-p96f-p2p2-2g3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to AdminNeo with SQLite connection
-
DeliveryUpload crafted SQL import with ~350,000 comment lines
-
ExploitCatastrophic backtracking makes preg_match() return false
-
ExecutionATTACH filter bypassed, malicious query reaches multiQuery()
-
PersistATTACH writes PHP file to web path
-
ImpactRequest file over HTTP to execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires an authenticated AdminNeo session with an active SQLite connection and access to the SQL file import feature (DIALECT == "sqlite"); the attacker uploads a SQL file whose ATTACH statement is preceded by roughly 350,000 SQLite line comments ( |
| Impact | No CVSS vector or score is provided by NVD/vendor (CVSS: N/A), and there is no EPSS score, no CISA KEV listing, and no confirmed public exploit in the supplied data, so quantitative exploitation signals are absent and the raw severity must be inferred from the mechanism. The GitHub Security Advisory (GHSA-p96f-p2p2-2g3h) and the patch commit confirm the core facts: this is a bypass of the fix for CVE-2021-43008, in which catastrophic backtracking in the |
| Exploit ScenarioDerived | An authenticated AdminNeo user who can reach the SQL import form while connected to a SQLite database uploads a crafted .sql file containing roughly 350,000 SQLite line-comment lines ( |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
AdminNeo versions before 5.5.1 contain a patch bypass in the SQLite SQL-import handler that restores a remote code execution primitive originally described in CVE-2021-43008. An authenticated user with an active SQLite connection uploads a SQL file whose ATTACH statement is preceded by roughly 350,000 SQLite line comments (--), driving the ~^$space*+ATTACH\b~i guard regex past PHP's pcre.backtrack_limit so that preg_match() returns false; the pre-5.5.1 code treats that false as a non-match, and the ATTACH query reaches Connection::get()->multiQuery(), letting the attacker write a .php file that executes when retrieved over HTTP. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the attacker must be authenticated; no CISA KEV listing, no EPSS score, and no confirmed public exploit code were present in the supplied data. Fixing it is a one-line change: AdminNeo 5.5.1 makes the check preg_match(...) !== 0, so a false return no longer passes the filter.
RemediationAI
Upgrade to AdminNeo 5.5.1 or later, which changes the ATTACH guard in admin/sql.inc.php to preg_match("~^$space*+ATTACH\\b~i", $q, $match) ! 0 so a preg_match() false result no longer bypasses the filter (release: https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1, commit: https://github.com/adminneo-org/adminneo/commit/7e5658ffb0d890cd1a6152a09e3172da85ca4b77, advisory: https://github.com/adminneo-org/adminneo/security/advisories/GHSA-p96f-p2p2-2g3h). Vendor-released patch: AdminNeo 5.5.1. If upgrading immediately is not possible, apply the one-line ! 0 comparison to the ATTACH check in admin/sql.inc.php as a manual backport, and in the interim restrict the SQL file import feature and SQLite dialect access to trusted administrators only, since the assessed vector requires an authenticated session (PR:L) with an active SQLite connection - noting that these restrictions are access-control trade-offs and do not correct the flawed return-value handling. Additional hardening consistent with the exploitation conditions: ensure the PHP process cannot write into directories served and executed by the web server, since the code-execution step depends on the dropped .php file being web-reachable and PHP-executable, and review pcre.backtrack_limit settings; neither measure is a substitute for patching because the underlying filter bypass remains present.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AdminNeo is a PHP database administration tool (a maintained fork lineage of Adminer) whose admin/sql.inc.php import handler reads an uploaded file into $query, splits it into individual statements, and for the SQLite dialect screens each statement with the regex ~^$space*+ATTACH\b~i, where $space = "(?:\\s|/\\*[\s\S]*?\*/|(?:#|$line_comment)[^\n]*\n?|--\r?\n)". The pattern combines alternations that all match whitespace or comments with a possessive quantifier, so a long run of -- line comments produces extreme backtracking inside PCRE; once pcre.backtrack_limit is exceeded, preg_match() returns false rather than 0 or 1. The vulnerability class is mapped to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e. injection), and the specific defect is an incorrect check of a function return value: the original code tested only truthiness, collapsing the distinct false (error) and 0 (no match) results. Because false was treated as 'no ATTACH found', the statement was forwarded to the multiQuery() sink, and SQLite's ATTACH can create a database file at an attacker-chosen path - including a .php file with embedded PHP that runs if served by the web server. The upstream fix in commit 7e5658ffb0d890cd1a6152a09e3172da85ca4b77 changes the comparison to !== 0, and the CHANGELOG entry for AdminNeo 5.5.1 records 'SQLite: Disallow ATTACH commands'. The package coordinate is composer/adminneo-org/adminneo, vulnerable below 5.5.1 and fixed in 5.5.1.
Know when Sqlite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Authenticated web user (PR:L) sends a crafted SQL import over the network (AV:N) with a deterministic backtracking trigger (AC:L, no victim interaction); successful bypass yields PHP write and RCE (C/I/A:H).
DescriptionCVE.org
Summary
This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking.
Originally reported by @zdi-disclosures in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7
Analysis
[Source] sql.inc.php :: SQL import handler:47
$query = get_file("sql_file", true, ";");> User uploads a malicious SQL file through the import form. The file content is read into the $query variable without any initial sanitization.
[Transform] sql.inc.php :: SQL import handler:87
// Query parsing loop that extracts individual SQL statements> The uploaded SQL content is processed in a loop that splits it into individual queries. Each query $query is extracted for processing.
[Context] sql.inc.php :: SQL import handler:65
$space = "(?:\\s|/\\*[\s\S]*?\\*/|(?:#|$line_comment)[^\n]*\n?|--\r?\n)";> Definition of the $space regex pattern used in the ATTACH filter. The possessive quantifier *+ combined with SQLite comment patterns (--) creates the catastrophic backtracking vulnerability when many comment lines are processed.
[Transform] sql.inc.php :: SQL import handler:146
if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) {> The ATTACH query filter check. When the regex encounters 350,000 SQLite comment lines (--), it triggers catastrophic backtracking. The possessive quantifier *+ causes exponential backtracking, eventually hitting PHP's backtracking limit and causing preg_match() to return false instead of 0 or 1, bypassing the security filter.
[Sink] sql.inc.php :: SQL import handler:162
Connection::get()->multiQuery($q)> When the ATTACH filter is bypassed due to the preg_match() returning false, the malicious SQL query containing the ATTACH statement is executed. This allows the attacker to create a .php file with embedded PHP code, achieving remote code execution when the file is accessed via HTTP.
The root cause is that PHP's preg_match() function returns false when the backtracking limit is exceeded, but the code only checks for truthy values (1 for match), treating false the same as 0 (no match). This allows the ATTACH statement to bypass the security filter.
-- CREDIT --------------------------------------- This vulnerability was discovered by: 0daystolive (Sorcery Ltd) working with TrendAI Zero Day Initiative
Zero Day Initiative zdi-disclosures@trendmicro.com
The PGP key used for all ZDI vendor communications is available from: http://www.zerodayinitiative.com/documents/disclosures-pgp-key.asc
-- INFORMATION ABOUT THE ZDI -------------------- Established by TippingPoint and acquired by Trend Micro, the Zero Day Initiative (ZDI) neither re-sells vulnerability details nor exploit code. Instead, upon notifying the affected product vendor, the ZDI provides its Trend Micro TippingPoint customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available.
Please contact us for further details or refer to:
http://www.zerodayinitiative.com
-- DISCLOSURE POLICY ---------------------------- Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and a
SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when hand
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles u
Memory corruption in SQLite versions before 3.50.2 allows network-based attackers with low privileges to manipulate aggr
An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. Rated high se
Arbitrary DLL loading in SQLite's sqldiff.exe utility on Windows allows attackers to achieve code execution by abusing t
Memory corruption in SQLite versions before 3.53.2 enables attackers to crash processes, exhaust memory, or potentially
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions i
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function
A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo functi
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
Exploit-DB