Adminer · Adminer
Adminer, an open-source single-file PHP database management tool, contains a server-side request forgery flaw in versions from 4.0.0 before 4.7.9, affecting deployments that use the bundled-drivers build (such as adminer.php). An attacker with network access can make the server issue requests to destinations of their choosing, without authentication or user interaction, and no non-default configuration is required.
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
First seen exploited 15 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 12 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
6 fixes in vrana/adminer over 8 years. The latest fix listed for vrana/adminer is 5.4.2.
unauthenticated SSRF against public-facing web app
there is a server-side request forgery vulnerability
SSRF proxies requests through the vulnerable server
Adminer is an open-source database management in a single PHP file
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: vrana/adminer.
Upgrade to 4.7.9 or later
Set the version to 4.7.9 or later in your composer.json.
The first fix for CVE-2021-21311. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| All versions before 4.7.9 | 4.7.9 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.