Adminer versions before 5.4.3 do not sanitize the server field when building a PDO DSN string, allowing attackers to inject ODBC parameters using semicolons. An attacker can inject TraceFile and TraceOn parameters to write arbitrary PHP code to the web root. When the trace file is accessed, the server executes the injected code, resulting in remote code execution. The vulnerability is identified as CWE-73.

The affected product is Adminer, developed by vrana. All releases before 5.4.3 are vulnerable; any deployment of Adminer prior to version 5.4.3 running with an exposed web front‑end is at risk.

The CVSS score of 9.3 signals a critical security flaw. The EPSS score is unavailable, but the fact that the attack requires only an unauthenticated HTTP request to the Adminer interface means a public exploit is feasible. The vulnerability is not listed in the CISA KEV catalog, yet the high CVSS score indicates it could be actively exploited if exposed. Attackers can leverage the lack of authentication to execute arbitrary PHP code on the target host.