AIKIDO-2026-394942

TL;DR

Adminer's login form validates the connection server string but only inspects a leading integer when enforcing the privileged-port restriction, so a value whose port begins with a non-digit is never range-checked. The unchecked value is interpolated into an unquoted PDO DSN, letting user-controlled host=/port=/unix_socket= keys be smuggled in and honoured last-key-wins by the PDO drivers. Because the connection is attempted before authentication, an unauthenticated request drives the server to open TCP connections to arbitrary internal hosts and ports and to arbitrary unix sockets, acting as a blind request-forgery and internal port-scan oracle. The fix tightens host and port validation, including privileged-port bounds, so smuggled DSN attributes are rejected.