CVE-2023-45195

What it actually does

The vulnerability permits unauthenticated SSRF by allowing arbitrary values in database connection host, port, and related fields, causing the server to issue outbound requests to attacker-controlled or internal targets.

Why it matters to the business

Attackers can reach internal systems and services that should be inaccessible from the internet, enabling reconnaissance, data exfiltration, or lateral movement without authentication.

How an attack unfolds

An unauthenticated attacker reaches the Adminer or AdminerEvo web interface, supplies a crafted database connection string pointing to an internal service or external target, and triggers the application to establish the connection, resulting in SSRF.

How to fix it

Upgrade AdminerEvo to the commit f1e13af9252bfd88d816ef72593513c13adf1dd5 or later release containing the fix (version 4.8.4 equivalent). Migrate any remaining Adminer installations to the supported AdminerEvo codebase.

How to confirm the fix worked

Confirm the deployed codebase contains commit f1e13af9252bfd88d816ef72593513c13adf1dd5 or is running AdminerEvo 4.8.4 or newer; test that database connection fields reject or sanitize non-database targets.

Typical attack path

1. Locate publicly reachable Adminer or AdminerEvo instance
2. Submit unauthenticated request containing malicious host/port values in the database connection form
3. Observe or capture responses or side effects from the server-initiated outbound connection
4. Repeat or chain requests to enumerate or interact with reachable internal systems

How to detect it

Review web server and application logs for unusual or repeated database connection attempts with non-standard host values; monitor outbound network traffic originating from the Adminer process for unexpected destinations.

What your security team should do

• Immediately upgrade all AdminerEvo instances to the fixed commit or 4.8.4 release
• Replace unsupported Adminer deployments with AdminerEvo
• Restrict network egress from the application server to only required database endpoints
• Place AdminerEvo behind authentication and network access controls