Executive brief
Adminer, a web-based database management tool, fails to properly escape database responses when building JavaScript code, allowing a malicious database server to execute arbitrary JavaScript in an authenticated user's session. In environments where the database server has file write permissions to the web application directory, this XSS can be escalated to remote code execution by writing PHP files that execute as the web server account.
Technical details
The vulnerability exists in the slow-query timeout handler, which inserts the unescaped result of CONNECTION_ID() directly into a JavaScript block that already carries a CSP nonce. A malicious MySQL-compatible database server can return JavaScript code instead of a numeric ID, executing arbitrary code in the authenticated origin. RCE requires additional preconditions: co-located database with FILE privileges, secure_file_priv permitting the webroot, and PHP execution enabled; the attacker can then write an auto-loaded adminer-plugins.php file via INTO DUMPFILE.
Affected products
- Vrana Adminer before 6.0.2
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: version 6.0.2 released