Infinit3I

**Name of the Vulnerable Software and Affected Versions** Adminer versions 4.6.0 through 5.5.0 **Description** An incomplete fix in the validation guard within `bootstrap.inc.php` allows certain values in the `X-Forwarded-Prefix` header to bypass security checks. While the system blocks prefixes starting with `//`, it permits values where the second character is a backslash, such as `/evil.com`. Since browsers normalize backslashes to forward slashes, this network-path reference persists in the `REQUEST URI` and reaches the `cookie path()` function, which affects the Set-Cookie Path attribute. This issue can be exploited if clients can set the `X-Forwarded-Prefix` header, typically due to a misconfigured or absent reverse proxy, resulting in anomalous cookie-path scoping. **Recommendations** Update Adminer to version 5.5.1. Restrict the ability of clients to set the `X-Forwarded-Prefix` header by properly configuring the reverse proxy.

**Name of the Vulnerable Software and Affected Versions** Adminer versions 4.6.0 through 5.4.x **Description** The software prepends the client-supplied `X-Forwarded-Prefix` header to `$ SERVER["REQUEST URI"]` without performing a trusted-proxy check or validating the prefix value. An attacker can provide an absolute URL via the `X-Forwarded-Prefix` header, which is then incorporated into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This allows for an authenticated open redirect following state-changing POST requests, unauthenticated control over the session cookie path attribute, and the poisoning of self-referential links. Header splitting and Cross-Site Scripting (XSS) are not possible as Carriage Return/Line Feed (CR/LF) characters cannot be injected. **Recommendations** Update to version 5.5.0 or later.

**Name of the Vulnerable Software and Affected Versions** Adminer versions prior to 5.5.0 **Description** A server-side request forgery (SSRF) issue exists in the login form's server field validator. The validator only checks leading integers for privileged ports and does not reject non-numeric port values. This allows attackers to inject PDO DSN keys, such as `host=` and `port=`, into the `server` parameter to bypass restrictions on privileged ports and establish TCP connections to arbitrary internal hosts and ports before authentication. **Recommendations** Update to version 5.5.0 or later.