Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Adminer v5.4.1 has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, opensslverify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Fix Upgrade to Adminer 5.4.2. Mitigation (if you can't upgrade): Make file adminer.version in temp directory (usually the value of uploadtmpdir) unwritable by web server. Details 1. Intended design of ?script=version: The endpoint is designed to receive version data from adminer.org via browser JavaScript: - functions.js line 102-117: Creates iframe to https://www.adminer.org/version/ - Adminer.org sends signed version data via postMessage - JavaScript POSTs this to ?script=version - Server stores in /tmp/adminer.version for signature…
Recommended action: Upgrade to 5.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Adminer script versions up to 4.6.2 contains file disclosure vulnerability.
Recommended action: Upgrade to 4.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Recommended action: Upgrade to 4.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users of MySQL, MariaDB, PgSQL and SQLite are affected. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a pdo extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. Patches Patched by 4043092, included in version 4.8.1. Workarounds Do both: Use browser supporting strict CSP. Enable the native PHP extensions (e.g. mysqli) or disable displaying PHP errors (displayerrors). References https://sourceforge.net/p/adminer/bugs-and-features/797/ For more information If you have any questions or comments about this advisory: Comment at 4043092.
Recommended action: Upgrade to 4.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact All users are affected. Patches Unsuccessfully patched by 0fae40fb, included in version 4.4.0. Patched by 35bfaa75, included in version 4.7.8. Workarounds Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin. References http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt https://sourceforge.net/p/adminer/bugs-and-features/769/ https://gusralph.info/adminer-ssrf-bypass-cve-2018-7667/ (CVE-2020-28654) For more information If you have any questions or comments about this advisory: Comment at 35bfaa75.
Recommended action: Upgrade to 4.7.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected. Patches Patched by ccd2374b, included in version 4.7.9. Workarounds Use a single driver version (e.g. adminer-mysql.php). Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin. References https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf For more information If you have any questions or comments about this advisory: Comment at ccd2374b.
Recommended action: Upgrade to 4.7.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected. Patches Patched by 5c395afc, included in version 4.7.9. Workarounds Use browser which encodes URL parameters (e.g. Chrome or Firefox). References https://sourceforge.net/p/adminer/bugs-and-features/775/ For more information If you have any questions or comments about this advisory: Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/
Recommended action: Upgrade to 4.7.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.