The flaw lies in Adminer’s multi_query method where an incorrect check of a function's return value allows a remote attacker to execute arbitrary code on the web server. Because the vulnerability can be triggered only when the attacker has authentication, the impact is limited to accounts that have legitimate access. The compromised server runs the injected code with the web server’s privileges, giving the attacker full control over the host, which results in a complete loss of confidentiality, integrity, and availability for the affected application and potentially for the underlying host system.

Adminer installations are impacted. No specific version numbers were listed, so any deployment that has not applied the latest security fix may be vulnerable. Administrators should review the Adminer release notes for the patch that addresses the multi_query check.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score of 1% indicates a low but nonzero likelihood of exploitation, while it remains not listed in the CISA KEV catalog, meaning no confirmed widespread exploitation is recorded. The attack requires the attacker to first authenticate to the Adminer application; therefore, the vector is authenticated remote access, and knowledge or compromise of user credentials is necessary. Once the attacker is authenticated, the flaw can be exploited to achieve remote code execution.