Executive brief
Adminer, a web-based database management tool, contains a flaw in how it parses server connection strings that allows unauthenticated attackers to bypass port restrictions. An attacker can craft a malicious server hostname to make Adminer initiate TCP connections to internal networks and privileged ports before any login credentials are validated. This enables attackers to perform internal network reconnaissance, probe for open services, and potentially access restricted systems on the network.
Technical details
The host_port() function in adminer/include/functions.inc.php uses a regex requiring pure digits for the port value and anchored to the end of the string. Any server string with a non-digit tail (e.g., "127.0.0.1:80/x") fails to match and returns the entire string as the host with an empty port. The privileged-port check in auth.inc.php only inspects the parsed port value, so it is bypassed when the port is empty. The mysqli/mysqlnd client then re-parses the host string and initiates a TCP connection to the intended host:port, including privileged ports. This is an unauthenticated network-based attack with no preconditions other than network access to the Adminer login page.
Affected products
- Vrana Adminer 5.5.1 through 6.0.1
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in version 6.0.2