Adminer versions 6.0.0 through 6.0.1 contain a pre‑authentication server‑side request forgery that is triggered when the ClickHouse driver plugin is loaded. An unauthenticated attacker can craft a request that sets the driver to "clickhouse" and the server value to any URL, causing the Adminer backend to send an HTTP POST containing "SELECT version()" to that host. If the target returns a non‑2xx response other than 401 or 403, the raw HTTP body is assigned to a connection error and rendered on the login page, giving the attacker the full response body from the internal service. This allows an attacker to gather internal network/port reconnaissance data, stack traces, hostnames, file paths, and configuration identifiers without authentication.

The flaw exists in the Adminer product from vendor vrana, specifically vulnerable in releases 6.0.0 and 6.0.1 when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php) is active. The issue is fixed in Adminer 6.0.2 and later releases, so any system running a patched version is no longer susceptible.

The CVSS score of 5.3 indicates a medium severity vulnerability, but the lack of an EPSS score means the likelihood of exploitation is uncertain. The vulnerability is listed as not in CISA’s KEV catalog, suggesting no known active exploitation. The attack requires only an unauthenticated HTTP request to the Adminer login endpoint, so it is trivial to attempt. If successful, the attacker gains internal network information and potential sensitive data from error pages, thereby compromising confidentiality and potentially aiding lateral movement. Close monitoring of web traffic to the Adminer login page and prompt patching are recommended to mitigate this risk.