Technical impact
Adminer before version 5.5.0 contains a server‑side request forgery vulnerability in the login form’s server field validator. The validator only checks the leading integer of the value to enforce privileged‑port restrictions and fails to reject non‑numeric port values. Attackers can inject PDO Data Source Name keys such as host= and port= into the server parameter, bypassing the restriction and allowing the server to open TCP connections to arbitrary internal hosts and ports before the user is authenticated. This can lead to unauthorized data access or internal scanning.
Affected Systems
The affected product is Adminer from the vrana vendor. This issue applies to all releases prior to 5.5.0, regardless of platform or operating system.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity, and the vulnerability is listed as not in the CISA KEV catalog. Exploitation requires remote access to the Adminer instance’s web interface; an attacker can craft a malicious login request containing the injected server parameter. Once the server processes this input, it will attempt outbound connections to the specified internal host or port, potentially exposing sensitive network resources. No authentication is required before the connection attempt, and the vulnerability is independent of user privileges, making it broadly exploitable when Adminer is reachable.
