Adminer
Monthly
Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated attackers to inject ODBC connection parameters through the unsanitized server field of the login form. Because the server value is placed directly into a PDO DSN string for MSSQL/ODBC connections, an attacker can smuggle TraceFile and TraceOn parameters via semicolons to write attacker-controlled PHP into the web root, which executes when the trace file is requested. CVSS 4.0 is rated 9.3 and the flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arbitrary PHP files to server-accessible paths and execute OS commands. The vulnerability exploits an incomplete command denylist: while Adminer restricts the ATTACH statement to limit direct file access, the VACUUM INTO command - which writes the current SQLite database to an arbitrary file path - was not blocked. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploit mechanism is straightforward for any authenticated user with SQLite access.
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-privilege user to deploy a webshell and execute arbitrary code as the web-server user. The root cause is a permissive default extension allowlist that fails to block .php uploads to columns with _path suffixes when the uploadPath directory is web-served. No public exploit has been identified at time of analysis, but the attack chain is technically trivial for anyone with Adminer credentials and requires no user interaction.
Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers operating in SQLite mode by abusing unvalidated relative path input in the db[] parameter during database drop operations. The root cause is a missing file extension check in the SQLite drop action (CWE-22 path traversal), allowing directory traversal sequences to escape the intended SQLite database directory. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the deterministic nature of path traversal exploitation makes the vulnerability straightforward to weaponize once authenticated access is obtained.
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the context of the web server by exploiting an incorrect function return value check in the multi_query method (CWE-253). The CVSS base score of 7.2 (High) reflects full confidentiality, integrity, and availability impact once authentication is satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a serious but not yet confirmed actively-exploited vulnerability.
Adminer versions 5.4.1 and earlier suffer from a post-message validation bypass that allows remote attackers to trigger denial of service affecting all users. By sending a crafted POST request with array parameters to the version endpoint, an attacker can cause openssl_verify() to receive malformed input, resulting in a TypeError that crashes the application and returns HTTP 500 errors. Public exploit code exists for this vulnerability; administrators should upgrade to version 5.4.2 immediately.
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Server-side request forgery in Adminer 5.5.1 through 6.0.1 lets a remote, unauthenticated attacker force the server to open outbound TCP connections to arbitrary internal hosts and privileged ports before any credentials are validated, by supplying a crafted login 'server' value such as '127.0.0.1:80/x'. The flaw is a regression that re-opens the privileged-port bypass originally fixed in 5.5.0, and because the connection is blind - the attacker only observes refused/handshake/timeout states - impact is limited to internal port scanning and SSRF probing rather than data disclosure or code execution. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor-released fix is Adminer 6.0.2.
Unauthenticated server-side request forgery in Adminer 6.0.0 and 6.0.1, when the optional ClickHouse driver plugin is loaded, allows remote attackers to make the server send HTTP POST requests containing 'SELECT version()' to arbitrary internal URLs and read the response bodies of services that return non-2xx/401/403 status codes, potentially exposing internal error pages with sensitive information. The vulnerability is gated by the presence of the ClickHouse driver plugin and does not affect default Adminer installations. No public exploit code has been identified at time of analysis, and the vendor has released Adminer 6.0.2 to fix the issue.
Server-side request forgery in Adminer's optional Elasticsearch driver (plugins/drivers/elastic.php) lets unauthenticated remote attackers force the Adminer host to issue HTTP GET requests to arbitrary reachable hosts and ports, because include/auth.inc.php calls Driver::connect() before it validates the submitted login result. Versions 4.16.0 through 6.0.1 are affected and the issue is conditional: it requires that the optional Elasticsearch driver be explicitly deployed (via the adminer/elastic.php template or an adminer_object() configuration) and that PHP allow_url_fopen be enabled so get_url()/file_get_contents() can send the outbound request. Impact is limited to low-confidentiality reconnaissance - a port-scanning oracle built from leaked JSON error fields and connection-failure text rendered on the login page - with no integrity or availability impact, and the independent assessment rates the issue MEDIUM, consistent with the vendor's CVSS 4.0 base score of 6.9; fixed in 6.0.2 and no public exploit identified at time of analysis.
Cross-site scripting in Adminer before 6.0.2 allows a malicious database server to execute arbitrary JavaScript in an authenticated Adminer session by returning a crafted CONNECTION_ID() result that is interpolated into JavaScript without escaping. The base XSS requires a victim to initiate a connection to the malicious server (UI:P); in co-located deployments where the database account holds FILE privileges and the webroot is writable, this can escalate to remote code execution via SQL writes using INTO DUMPFILE. No public exploit code has been identified at time of analysis, and exploitation requires specific non-default conditions for the RCE escalation.
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack is meaningful against administrators and developers who routinely connect Adminer instances to external or third-party MySQL servers.
Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.
Adminer 4.6.0 through 5.4.x blindly prepends the client-supplied X-Forwarded-Prefix HTTP header to internally constructed URLs with no trusted-proxy allowlist or value sanitization, allowing attacker-controlled URL prefixes to propagate into Location redirect headers, Set-Cookie path attributes, and self-referential links. This yields an authenticated open redirect on state-changing POSTs and unauthenticated control of session cookie path scoping against default deployments in the affected version range. CR/LF injection is blocked, ruling out header splitting and XSS despite the intelligence source's XSS tag - that tag appears to be a mis-classification and should not inflate risk estimates. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Adminer is open-source database management software. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adminer through 4.3.1 has SSRF via the server parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in Adminer before 5.4.3 (the single-file PHP database management tool) allows unauthenticated attackers to inject ODBC connection parameters through the unsanitized server field of the login form. Because the server value is placed directly into a PDO DSN string for MSSQL/ODBC connections, an attacker can smuggle TraceFile and TraceOn parameters via semicolons to write attacker-controlled PHP into the web root, which executes when the trace file is requested. CVSS 4.0 is rated 9.3 and the flaw was reported by VulnCheck; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arbitrary PHP files to server-accessible paths and execute OS commands. The vulnerability exploits an incomplete command denylist: while Adminer restricts the ATTACH statement to limit direct file access, the VACUUM INTO command - which writes the current SQLite database to an arbitrary file path - was not blocked. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploit mechanism is straightforward for any authenticated user with SQLite access.
Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-privilege user to deploy a webshell and execute arbitrary code as the web-server user. The root cause is a permissive default extension allowlist that fails to block .php uploads to columns with _path suffixes when the uploadPath directory is web-served. No public exploit has been identified at time of analysis, but the attack chain is technically trivial for anyone with Adminer credentials and requires no user interaction.
Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers operating in SQLite mode by abusing unvalidated relative path input in the db[] parameter during database drop operations. The root cause is a missing file extension check in the SQLite drop action (CWE-22 path traversal), allowing directory traversal sequences to escape the intended SQLite database directory. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the deterministic nature of path traversal exploitation makes the vulnerability straightforward to weaponize once authenticated access is obtained.
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the context of the web server by exploiting an incorrect function return value check in the multi_query method (CWE-253). The CVSS base score of 7.2 (High) reflects full confidentiality, integrity, and availability impact once authentication is satisfied. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the category of a serious but not yet confirmed actively-exploited vulnerability.
Adminer versions 5.4.1 and earlier suffer from a post-message validation bypass that allows remote attackers to trigger denial of service affecting all users. By sending a crafted POST request with array parameters to the version endpoint, an attacker can cause openssl_verify() to receive malformed input, resulting in a TypeError that crashes the application and returns HTTP 500 errors. Public exploit code exists for this vulnerability; administrators should upgrade to version 5.4.2 immediately.
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Server-side request forgery in Adminer 5.5.1 through 6.0.1 lets a remote, unauthenticated attacker force the server to open outbound TCP connections to arbitrary internal hosts and privileged ports before any credentials are validated, by supplying a crafted login 'server' value such as '127.0.0.1:80/x'. The flaw is a regression that re-opens the privileged-port bypass originally fixed in 5.5.0, and because the connection is blind - the attacker only observes refused/handshake/timeout states - impact is limited to internal port scanning and SSRF probing rather than data disclosure or code execution. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; the vendor-released fix is Adminer 6.0.2.
Unauthenticated server-side request forgery in Adminer 6.0.0 and 6.0.1, when the optional ClickHouse driver plugin is loaded, allows remote attackers to make the server send HTTP POST requests containing 'SELECT version()' to arbitrary internal URLs and read the response bodies of services that return non-2xx/401/403 status codes, potentially exposing internal error pages with sensitive information. The vulnerability is gated by the presence of the ClickHouse driver plugin and does not affect default Adminer installations. No public exploit code has been identified at time of analysis, and the vendor has released Adminer 6.0.2 to fix the issue.
Server-side request forgery in Adminer's optional Elasticsearch driver (plugins/drivers/elastic.php) lets unauthenticated remote attackers force the Adminer host to issue HTTP GET requests to arbitrary reachable hosts and ports, because include/auth.inc.php calls Driver::connect() before it validates the submitted login result. Versions 4.16.0 through 6.0.1 are affected and the issue is conditional: it requires that the optional Elasticsearch driver be explicitly deployed (via the adminer/elastic.php template or an adminer_object() configuration) and that PHP allow_url_fopen be enabled so get_url()/file_get_contents() can send the outbound request. Impact is limited to low-confidentiality reconnaissance - a port-scanning oracle built from leaked JSON error fields and connection-failure text rendered on the login page - with no integrity or availability impact, and the independent assessment rates the issue MEDIUM, consistent with the vendor's CVSS 4.0 base score of 6.9; fixed in 6.0.2 and no public exploit identified at time of analysis.
Cross-site scripting in Adminer before 6.0.2 allows a malicious database server to execute arbitrary JavaScript in an authenticated Adminer session by returning a crafted CONNECTION_ID() result that is interpolated into JavaScript without escaping. The base XSS requires a victim to initiate a connection to the malicious server (UI:P); in co-located deployments where the database account holds FILE privileges and the webroot is writable, this can escalate to remote code execution via SQL writes using INTO DUMPFILE. No public exploit code has been identified at time of analysis, and exploitation requires specific non-default conditions for the RCE escalation.
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.
Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack is meaningful against administrators and developers who routinely connect Adminer instances to external or third-party MySQL servers.
Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.
Adminer 4.6.0 through 5.4.x blindly prepends the client-supplied X-Forwarded-Prefix HTTP header to internally constructed URLs with no trusted-proxy allowlist or value sanitization, allowing attacker-controlled URL prefixes to propagate into Location redirect headers, Set-Cookie path attributes, and self-referential links. This yields an authenticated open redirect on state-changing POSTs and unauthenticated control of session cookie path scoping against default deployments in the affected version range. CR/LF injection is blocked, ruling out header splitting and XSS despite the intelligence source's XSS tag - that tag appears to be a mis-classification and should not inflate risk estimates. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Adminer is open-source database management software. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adminer through 4.3.1 has SSRF via the server parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.