Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking. Originally reported by @zdi-disclosures in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7 Analysis [Source] sql.inc.php :: SQL import handler:47 ```php $query = get_file("sql_file", true, ";"); ``` > User uploads a malicious SQL file through the import form. The file content is read into the `$query` variable without any initial sanitization. [Transform] sql.inc.php :: SQL import handler:87 ```php // Query parsing loop that extracts individual SQL statements ``` > The uploaded SQL…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted `db[]` values directly to `unlink()`. Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc Impact An authenticated AdminNeo SQLite user with a valid CSRF token can submit an arbitrary relative file path in the database-list `db[]` field. If the PHP process can delete that path, AdminNeo unlinks it even when the file is not a SQLite database. Root Cause The database-list page accepts selected database names from the POST body and calls `drop_databases()`: ```php if ($_POST["db"]) { queries_redirect(substr(ME, 0, -1), lang('Databases have been dropped.'), drop_databases($_POST["db"])); } ``` In SQLite mode,…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including `Domain`, `Path`, `Secure`, and `SameSite` into all `Set-Cookie` response headers emitted by AdminNeo. This allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., `Domain=.evil.com`), causing the victim's browser to send AdminNeo's `neo_sid` (session ID) and `neo_key` (database password encryption key) cookies to the attacker's server on subsequent requests. Originally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h Vulnerable Code Root cause 1 - Unsanitized header prepended to `REQUEST_URI`…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AdminNeo inserts the database server's version string into a ` ` tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has a valid nonce, the browser's Content Security Policy does not block execution. No authentication is required when combined with Login CSRF. Originally reported in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj Prerequisites - Target runs AdminNeo - Attacker controls a reachable MySQL server (a 80-line Python script) Root Cause `admin/core/Admin.php`, lines 1285-1286: ```php echo script("let autocompletion;\nwindow.addEventListener('DOMContentLoaded', () => { initSyntaxHighlighting('" . Connection::get()->getVersion() . "', '" . Connection::get()->getFlavor() . "', autocompletion); });"); ``` `script()` wraps the output in ` `. Return value of…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands. Originally reported in Adminer: GHSA-q4f2-39gr-45jh Root Cause sql.inc.php, line 146: ```php if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) { // blocked } ``` Only `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked. Steps To Reproduce 1. Login to SQLite 1. Open AdminNeo and select driver: SQLite 2. Login and create a new database (e.g., `stage.db`) 2. Inject PHP code and write the shell Navigate…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token (via network sniffing, log files, Referrer header, or XSS) to instantly recover the session secret and forge unlimited valid CSRF tokens. Additionally, the underlying session token has only ~20 bits of entropy (`rand(1, 1e6)`), making blind brute-force feasible even without token observation. Originally reported by @az0mb13 in Adminer: GHSA-q4f2-39gr-45jh Details Token generation in `admin/include/functions.inc.php` lines 1181-1184: ```php function get_token() { $rand = rand(1, 1e6); return ($rand ^ $_SESSION["token"]) . ":$rand"; } ``` Token verification in lines 1189-1192: ```php function verify_token() { list($token, $rand) = explode(":", $_POST["token"]); return ($rand ^…
Recommended action: Upgrade to 5.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours. Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted. Workaround If you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of upload_tmp_dir) unwritable by web server. Details 1. Intended design of `?script=version` The endpoint is designed to receive version…
Recommended action: Upgrade to 5.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.