File Upload Vulnerability in Adminer and AdminerEvo Allows Execution of Uploaded Files
CVE-2023-45197

9.8CRITICAL

Key Information:

Vendor

Adminer

Status
Adminer
Adminerevo
Vendor
CVE Published:
21 June 2024

What is CVE-2023-45197?

A security vulnerability exists in the file upload plugin of Adminer and AdminerEvo that permits an attacker to upload files using a table name of '…', enabling potential unauthorized file execution within the Adminer directory. While the original Adminer product is no longer maintained, the vulnerability has been addressed in the updated version of AdminerEvo (4.8.3). Users are encouraged to upgrade to this version to mitigate risks related to this exploit.

Affected Version(s)

Adminer 0

Adminer cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*

AdminerEvo 4.8.2 < 4.8.3

References

https://github.com/adminerevo/adminerevo/commit/1cc06d6a1...
patch
https://github.com/adminerevo/adminerevo/releases/tag/v4.8.3
release-notes

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.