Executive brief
Adminer, a popular open-source database management tool, contains a security flaw that allows attackers to make unauthorized network requests from the server. This could allow an attacker to scan internal networks, access sensitive internal services, or steal data that is not normally exposed to the internet. This vulnerability has been observed being used in active attacks, making immediate patching critical for organizations using this software.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Adminer versions 4.0.0 through 4.7.8, specifically affecting the 'adminer.php' distribution which bundles all database drivers. The flaw allows an unauthenticated remote attacker to force the server to initiate requests to arbitrary local or remote endpoints. This can be leveraged to bypass firewalls, perform internal port scanning, or access metadata services in cloud environments. The vulnerability is rooted in insufficient validation of user-supplied input used to establish database connections. A fix is available in version 4.7.9.
Affected products
- Adminer Adminer 4.0.0 to 4.7.8
Timeline
- 2021-02-18: disclosed
- 2021-02-18: patched: Fixed in version 4.7.9
- 2025-09-29: kev added: Added to CISA KEV due to active exploitation