PT-2022-11760 · Adminer · Adminer

Podalirius · Published 2021-07-17 · Updated 2025-11-18 · CVE-2021-43008

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adminer versions 1.12.0 through 4.6.2

Description The issue allows an attacker to achieve arbitrary file read on a remote server by requesting Adminer to connect to a remote MySQL database, due to improper access control.

Recommendations For Adminer versions 1.12.0 through 4.6.2, update to version 4.6.3 to resolve the issue.

Exploit

Fix

Improper Access Control

Files Accessible to External Parties

Weakness Enumeration

CWE-284

CWE-552

Related Identifiers

BDU:2025-14681

CVE-2021-43008

DLA-3002-1

GHSA-RXFQ-3VPC-VV72

Affected Products

Adminer

References · 21

• 🔥 https://github.com/p0dalirius/CVE-2021-43008-AdminerRead · Exploit
• 🔥 https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability · Exploit
• 🔥 https://podalirius.net/en/cves/2021-43008 · Exploit
• https://osv.dev/vulnerability/DLA-3002-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43008 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-43008 · Security Note
• https://bdu.fstec.ru/vul/2025-14681 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-43008 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43008 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-43008 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43008 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxfq-3vpc-vv72 · Vendor Advisory
• https://github.com/vrana/adminer/releases/tag/v4.6.3 · Note
• https://github.com/vrana/adminer · Note