The flaw lies in Adminer’s multi_query method where an incorrect check of a function’s return value allows a remote attacker to execute arbitrary code on the web server. Because the vulnerability can be triggered only when the attacker has authentication, the impact is limited to accounts that have legitimate access. The compromised server runs the injected code with the web server’s privileges, giving the attacker full control over the host. This results in a complete loss of confidentiality, integrity and availability for the affected application and potentially for the underlying host system.

Adminer installations are impacted. No specific version numbers were listed by the CNA, so any deployment of Adminer that has not applied the latest security fix may be vulnerable. Administrators should review the Adminer release notes for the patch that addresses the multi_query check.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score is not available, so it is unclear how frequently this vulnerability is being exploited in the wild, but it is listed in the CISA KEV catalog as not listed, meaning no confirmed widespread exploitation is recorded. The attack requires the attacker to first authenticate to the Adminer application; therefore, the vector is authenticated remote access, and knowledge or compromise of user credentials is necessary. Once the attacker is authenticated, the flaw can be exploited to achieve remote code execution.