Arbitrary File Deletion in Adminer via SQLite Mode

Executive Summary

Adminer before version 5.4.3 has an arbitrary file deletion vulnerability in SQLite mode. When using the database-list drop action, the application fails to validate file extensions before deleting files. An authenticated attacker can submit relative file paths in the db[] parameter to delete any file writable by the PHP process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Adminer versions before 5.4.3 are installed on your system. Review Adminer's SQLite mode database-list functionality for suspicious file deletion attempts in logs. Look for POST requests to the database-list drop action with arbitrary file paths in the db[] parameter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to delete critical files on the server where Adminer is running. This could lead to data loss, system instability, or denial of service if important files are removed. Attackers could target configuration files, databases, or other sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file deletion, potentially resulting in data breaches or loss of protected health information. Organizations may face penalties for failing to protect sensitive data adequately.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Adminer to version 5.4.3 or later. If upgrading is not possible, implement strict validation for the db[] parameter to ensure only valid SQLite database files (.db, .sdb, .sqlite) can be deleted. Restrict file system permissions for the PHP process to limit file deletion scope.

Useful 0 Not Useful 0