CyberRota Analysis
AI-GeneratedAdminer versions prior to 5.4.3 are vulnerable to a remote code execution flaw in SQLite query handling, allowing authenticated attackers to bypass ATTACH restrictions and execute arbitrary PHP code via the VACUUM INTO command. This vulnerability poses a significant risk as it enables attackers to write files to arbitrary paths on the server, potentially leading to full system compromise. Organizations using affected versions should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.