Description

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-26T14:16:54.297Z",
  "pubdate": "2026-09-26T14:16:54.297Z",
  "executiveSummary": "Adminer versions prior to 6.0.2 are susceptible to a Cross-Site Scripting (XSS) vulnerability stemming from improper input sanitization of database-returned metadata. By manipulating the CONNECTION_ID() result, an attacker operating a malicious database server can force an authenticated Adminer session to execute arbitrary JavaScript within the context of the origin.\nThe impact of this vulnerability is severe, as it facilitates unauthorized authenticated SQL command execution. In environments where the database service possesses FILE privileges and shared filesystem access to the webroot, this XSS primitive can be leveraged to achieve Remote Code Execution (RCE) by crafting SQL queries that utilize the INTO DUMPFILE directive to write arbitrary PHP payloads to the server filesystem.\nSuccessful exploitation requires the victim to connect to an attacker-controlled database instance through the vulnerable Adminer interface. While the primary vector is XSS, the resultant RCE allows for complete system compromise, bypassing application-level security controls and potentially leading to lateral movement or data exfiltration. Organizations deploying Adminer in co-located or shared-hosting environments are at significant risk.",
  "technicalDetails": "The vulnerability resides in the insecure interpolation of the CONNECTION_ID() database result into the administrative interface's JavaScript context. Adminer fails to properly sanitize or escape data returned by the database server before rendering it, creating a classic reflected XSS vector. An attacker-controlled database server can return a specially crafted CONNECTION_ID() string containing malicious JavaScript payloads, which is then executed by the browser of any user authenticated to that database session via Adminer.\nThe attack flow begins when an administrator or authenticated user connects Adminer to a malicious MySQL/MariaDB instance. During the initial handshake or status retrieval, the database server provides a manipulated connection identifier. Because Adminer renders this metadata directly into the DOM without escaping, the embedded JavaScript is executed in the user's browser session. This session maintains active credentials for the Adminer interface, which the payload can leverage.\nIf the database user configured in Adminer holds the FILE privilege, the attacker can move beyond client-side XSS. The injected JavaScript payload can programmatically submit background SQL commands through the legitimate Adminer API. By issuing a request to perform a SELECT INTO DUMPFILE operation, the attacker can write an arbitrary PHP web shell directly into the web server's document root. Since the web server and the database service often share the same filesystem in co-located deployments, the database service's ability to write to disk allows for the placement of executable PHP code.\nOnce the web shell is written, the attacker can access the file via the browser to execute arbitrary system commands under the context of the web server service account. This escalation from XSS to RCE highlights the dangers of trust in database-provided metadata and the risks of excessive file-system privileges granted to database service accounts. The vulnerability is present in all versions before 6.0.2, affecting all deployment configurations where users may be convinced to connect to arbitrary, untrusted database instances.\nAuthentication is required to trigger the connection, but the vulnerability is exacerbated in multi-user environments where administrative users may connect to various databases, including those controlled by internal or external malicious actors."
}