Executive brief
Adminer is a database administration tool with a web-based login interface. An unauthenticated attacker can inject database connection string parameters into the server field to bypass port-restriction checks and force the server to initiate TCP connections to arbitrary internal hosts and ports, potentially exposing internal services, revealing open ports, or facilitating further attacks before any user login occurs.
Technical details
The vulnerability is a server-side request forgery (SSRF) in Adminer's login form caused by improper validation of the server parameter before it is interpolated into a PDO DSN. The port-validation function (auth.inc.php:179) only rejects ports that begin with an integer in the privileged range (<1024), allowing non-numeric ports like "zzz;host=10.0.0.5;port=22" to pass validation. When this crafted value is used to build the PDO DSN (e.g., mysql.inc.php:180), the PDO driver parses the injected semicolon-delimited keys and applies the last-appearing host=/port= values, bypassing the validator's restrictions. An attacker can submit the login form pre-authentication with a malicious server parameter to establish TCP connections to arbitrary internal endpoints. The issue affects PDO_MySQL, PDO_DBLIB, PDO_SQLSRV, and PDO_OCI drivers; PostgreSQL is not affected due to quoting in its DSN handling. The vulnerability was fixed in version 5.5.0.
Affected products
- Adminer Adminer before 5.5.0
Timeline
- 2026-07-17: disclosed
- 2026-08-25: patched: version 5.5.0 released