CyberRota Analysis
AI-GeneratedAdminer versions prior to 5.5.0 are vulnerable to a server-side request forgery (SSRF) flaw in the login form's server field validator, which inadequately checks for non-numeric port values. This vulnerability allows attackers to inject PDO DSN keys, potentially enabling them to connect to internal services and ports without authentication. Organizations using Adminer should prioritize patching to mitigate the risk of unauthorized access to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.