Arbitrary File Write in Adminer via SQL-Log Plugin Path Traversal

Executive Summary

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled have an arbitrary file write vulnerability. An authenticated user can exploit path traversal sequences in the ns parameter of plugins/sql-log.php to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.

Useful 0 Not Useful 0

Detection Guidance

Check if Adminer versions 5.3.0 through 5.4.2 are installed and if the sql-log plugin is enabled. Inspect network traffic for requests to plugins/sql-log.php with path traversal sequences in the ns parameter. Look for unexpected .sql files in writable directories on the host.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to write arbitrary files to the system, potentially causing disk exhaustion or executing malicious SQL commands if the operator imports a malicious .sql file. It requires authentication but has low attack complexity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes. An attacker could write malicious .sql files to sensitive directories, potentially leading to data exfiltration or unauthorized modifications. For GDPR, this may violate integrity and confidentiality principles. For HIPAA, it could compromise protected health information integrity if database files are altered.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the sql-log plugin in Adminer immediately. Update Adminer to a version outside the vulnerable range (5.3.0-5.4.2). Restrict file write permissions on directories accessible by Adminer. Monitor for unauthorized file creation or suspicious activity in logs.

Useful 0 Not Useful 0