Executive brief
Adminer is a popular web-based database management tool used to administer databases. A flaw in its CSRF protection allows attackers who observe even a single session token (through network logs, browser history, or other means) to instantly recover the session secret and forge unlimited forged tokens. This enables attackers to execute arbitrary SQL commands, delete databases, create backdoor accounts, or modify data on behalf of authenticated users without their knowledge or consent.
Technical details
The vulnerability exists in Adminer's CSRF token generation and verification (functions.inc.php lines 897-905 and auth.inc.php lines 150 and 205). The token format (rand XOR secret):rand transmits both the XOR mask and masked value, allowing trivial recovery of the session secret via a single XOR operation (secret = masked_value XOR rand). Three compounding weaknesses: (1) instant secret recovery from any observed token, (2) low entropy session tokens (only ~20 bits from rand(1,1e6), enabling blind brute-force), and (3) loose comparison (==) in token verification allowing PHP type juggling. Exploitation requires observing a valid CSRF token or brute-forcing the low-entropy session secret, then generating forged tokens to execute arbitrary SQL queries within an authenticated session. The vulnerability has been patched in version 5.4.3.
Affected products
- Adminer Project Adminer before 5.4.3
Timeline
- 2026-07-09: disclosed
- 2026-08-25: advisory