CVE-2023-45196

What it actually does

Unauthenticated remote attacker triggers denial of service by supplying an attacker-controlled HTTP endpoint that issues redirect responses; PHP configuration limits determine the resulting resource exhaustion in Adminer or AdminerEvo components.

Why it matters to the business

Service interruption for database administration interfaces can cause operational downtime and require manual intervention to restore availability, with low exploitation likelihood reducing immediate urgency.

How an attack unfolds

Attacker configures a redirecting HTTP service, then supplies its URL to the vulnerable Adminer/AdminerEvo instance; repeated redirect responses consume resources until PHP limits are reached, resulting in denial of service. No named threat actors or campaigns are associated with this issue.

How to fix it

Upgrade centreon/centreon to commit b0c74f195b1b48c7af9ec168db3cfbcade99da7f or later; replace any unsupported Adminer deployments with AdminerEvo 4.8.4 or newer.

How to confirm the fix worked

Confirm the deployed commit hash or version string matches the fixed revision; test that redirect loops no longer cause resource exhaustion under controlled conditions.

Typical attack path

1. Identify an exposed Adminer or AdminerEvo endpoint
2. Stand up an attacker-controlled HTTP service that issues redirects
3. Submit the malicious endpoint URL to the target instance
4. Observe resource consumption until PHP limits trigger denial of service

How to detect it

Examine web server and application logs for repeated outbound connections or redirect responses originating from Adminer/AdminerEvo processes; correlate with PHP resource limit warnings.

What your security team should do

• Apply the listed commit or AdminerEvo 4.8.4 upgrade across all instances within normal change windows
• Review PHP configuration limits around network and redirect handling
• Monitor for any future Adminer-related disclosures given the unsupported status of the original project