AIKIDO-2026-518559
vrana/adminer is vulnerable to Argument Injection
98
Critical Risk
This Affects:
vrana/adminerTL;DR
Adminer interpolates the server login field into a PDO DSN string without escaping, so semicolons are treated as DSN parameter delimiters. Unauthenticated input can append ODBC options such as TraceFile and TraceOn, causing the driver to write a trace file containing the submitted username to an arbitrary path before the connection is attempted. Placing PHP code in the username writes an executable web shell, leading to remote code execution without authentication when the MSSQL driver stack is present. The fix validates the server value before building the DSN.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, the pdo_sqlsrv extension with the Microsoft ODBC driver is installed and the web root is writable by the web server.
Background info
vrana/adminer is vulnerable to Argument Injection in versions 0.0.1 - 5.4.2.
How to fix this
Upgrade the vrana/adminer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant