PT-2026-81130 · Adminer · Adminer
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Adminer versions prior to 5.4.3
Description
An issue exists in SQLite query handling where the
VACUUM INTO command is not blocked despite restrictions on the ATTACH statement. Authenticated attackers can leverage this to write PHP code to arbitrary file paths, leading to remote code execution on the server.Recommendations
Update to version 5.4.3 or later.
Exploit
Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Adminer