Amirmsafari

**Name of the Vulnerable Software and Affected Versions** Adminer versions prior to 5.4.3 **Description** The software inserts unsanitized database server version strings into script tags containing valid Content Security Policy (CSP) nonces without proper validation. An attacker controlling a rogue MySQL server can provide crafted version strings to break out of the JavaScript context and execute arbitrary code, effectively bypassing CSP protections. **Recommendations** Update to version 5.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** Adminer versions prior to 5.4.3 **Description** An issue exists in SQLite query handling where the `VACUUM INTO` command is not blocked despite restrictions on the `ATTACH` statement. Authenticated attackers can leverage this to write PHP code to arbitrary file paths, leading to remote code execution on the server. **Recommendations** Update to version 5.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** Adminer versions prior to 5.4.3 **Description** Insufficient sanitization of the server field during the construction of a PDO DSN (Data Source Name) string allows unauthenticated attackers to inject ODBC parameters using semicolons. By injecting the `TraceFile` and `TraceOn` parameters, an attacker can write PHP code directly into the web root, leading to remote code execution when the resulting trace file is accessed. **Recommendations** Update to version 5.4.3 or later.