Information disclosure in Adminer

Published: 2019-01-18
Severity Medium
Patch available YES
Number of vulnerabilities 1
CVE ID N/A
CWE ID CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software Adminer Subscribe
Vendor Jakub Vrána

Security Advisory

This security advisory describes one medium risk vulnerability.

1) Information disclosure

Severity: Medium

CVSSv3: 6.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-200 - Information Exposure

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to passwords leak. A remote attacker needs a modified MySQL server, which is altered to send out data import requests to any client that connects to find an open adminer.php on the victim system, instruct Adminer to connect to his rigged MySQL server (external connections are actually a feature of Adminer) and connect to the foreign server, login with the credentials, and immediately receive a data import request from the server for a specific file.

Successful exploitation of the vulnerability may allow to steal private data or inject a skimmer.

Note: the vulnerability is been actively exploited by a hacking group Megacart.

Mitigation

Update to version 4.7.0.

Vulnerable software versions

Adminer: 4.3.1, 4.4.0, 4.5.0, 4.6.0, 4.6.1, 4.6.2

CPE External links

https://gwillem.gitlab.io/2019/01/17/adminer-4.6.2-file-disclosure-vulnerability/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



ImmuniWeb® AI Platform for Application Security Testing