Summary
Adminer contains a code injection vulnerability in its SQLite handling that can allow authenticated database users to bypass restrictions on database attachment and file output. Under affected conditions, an attacker may place database content at a PHP-served path and cause PHP code to execute with the web server's privileges.
Adminer contains a code injection vulnerability in its SQLite handling that can allow authenticated database users to bypass restrictions on database attachment and file output. Under affected conditions, an attacker may place database content at a PHP-served path and cause PHP code to execute with the web server's privileges.
Affected context
The issue can arise in Adminer deployments that permit authenticated users to manage SQLite databases and expose Adminer or related PHP content through a web server. It depends on SQLite operations being insufficiently restricted when statements contain a UTF-8 byte-order mark, combined with the ability to write database content to a PHP-served location.
The issue can arise in Adminer deployments that permit authenticated users to manage SQLite databases and expose Adminer or related PHP content through a web server. It depends on SQLite operations being insufficiently restricted when statements contain a UTF-8 byte-order mark, combined with the ability to write database content to a PHP-served location.
Exploit preconditions
- Attack surface: Adminer's authenticated SQLite database-management functionality
- Required access: Valid credentials for an account permitted to use SQLite operations
- Trigger point: Processing SQLite statements involving restricted ATTACH or VACUUM INTO operations
- Why exploitation is possible: A UTF-8 byte-order mark can bypass statement restrictions, allowing database content to be written to a PHP-served path where PHP-formatted content may be interpreted by the web server
- Attack surface: Adminer's authenticated SQLite database-management functionality
- Required access: Valid credentials for an account permitted to use SQLite operations
- Trigger point: Processing SQLite statements involving restricted ATTACH or VACUUM INTO operations
- Why exploitation is possible: A UTF-8 byte-order mark can bypass statement restrictions, allowing database content to be written to a PHP-served path where PHP-formatted content may be interpreted by the web server
Why this happens
The underlying flaw is an incomplete restriction on SQLite statements. Validation appears to recognize or block prohibited operations based on the beginning of the statement, while a UTF-8 byte-order mark can alter how that boundary is interpreted without changing the statement's effective meaning to SQLite.
This permits operations that can write attacker-controlled database content to a location processed as PHP code. The resulting failure to keep database content separate from executable server-side code maps to CWE-94: Improper Control of Generation of Code (Code Injection).
The underlying flaw is an incomplete restriction on SQLite statements. Validation appears to recognize or block prohibited operations based on the beginning of the statement, while a UTF-8 byte-order mark can alter how that boundary is interpreted without changing the statement's effective meaning to SQLite.
This permits operations that can write attacker-controlled database content to a location processed as PHP code. The resulting failure to keep database content separate from executable server-side code maps to CWE-94: Improper Control of Generation of Code (Code Injection).
Potential impact
- An attacker may execute arbitrary PHP code with the web server's privileges
- The application or host may be compromised
- Sensitive files and database contents could be accessed or modified
- The attacker could alter hosted content or establish persistence
- Further compromise may be possible if the web server account has excessive permissions
- An attacker may execute arbitrary PHP code with the web server's privileges
- The application or host may be compromised
- Sensitive files and database contents could be accessed or modified
- The attacker could alter hosted content or establish persistence
- Further compromise may be possible if the web server account has excessive permissions
General mitigation guidance
Mitigation generally focuses on enforcing statement restrictions using parser-aware validation rather than simple prefix checks, including normalization of Unicode markers before policy evaluation.
Common defensive patterns include:
- Use a well-maintained Adminer release that contains appropriate security fixes
- Apply strict allowlists for SQLite operations exposed through administrative interfaces
- Normalize input before applying security policies and validation rules
- Prevent database-managed content from being written into PHP-served directories
- Store uploaded and generated database files outside executable web roots
- Run the web server with a dedicated, least-privileged account
- Disable unnecessary PHP execution in directories intended for data storage
- Separate database administration interfaces from public application serving paths
Mitigation generally focuses on enforcing statement restrictions using parser-aware validation rather than simple prefix checks, including normalization of Unicode markers before policy evaluation.
Common defensive patterns include:
- Use a well-maintained Adminer release that contains appropriate security fixes
- Apply strict allowlists for SQLite operations exposed through administrative interfaces
- Normalize input before applying security policies and validation rules
- Prevent database-managed content from being written into PHP-served directories
- Store uploaded and generated database files outside executable web roots
- Run the web server with a dedicated, least-privileged account
- Disable unnecessary PHP execution in directories intended for data storage
- Separate database administration interfaces from public application serving paths
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis and code review of statement filters that rely on raw string prefixes
- Tests covering Unicode normalization, byte-order marks, and alternate statement encodings
- Review of filesystem permissions and web-server execution policies for database directories
- Monitoring for unexpected SQLite ATTACH or VACUUM INTO activity
- File-integrity monitoring for new or modified files in PHP-served directories
- Web-server logs showing requests to recently created or modified application files
- Policy checks that prevent administrative database tools from writing executable content to web roots
Organizations can look for this weakness through:
- Static analysis and code review of statement filters that rely on raw string prefixes
- Tests covering Unicode normalization, byte-order marks, and alternate statement encodings
- Review of filesystem permissions and web-server execution policies for database directories
- Monitoring for unexpected SQLite ATTACH or VACUUM INTO activity
- File-integrity monitoring for new or modified files in PHP-served directories
- Web-server logs showing requests to recently created or modified application files
- Policy checks that prevent administrative database tools from writing executable content to web roots
