Description (CNA)
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| vrana / adminer | affected 0 before 6.1.1; unaffected 6.1.1 |
CWE
CWE-94
References
- https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59
- https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass
ADP enrichment
No English description supplied.