Adminer 4.0.0-4.7.8 - Server-Side Request Forgery
Title source: llmExploitation Summary
CVE-2021-21311 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 29, 2025. EIP tracks 4 public exploits from researchers including omoknooni, Sudo-WP. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-21311, an SSRF vulnerability in Adminer versions 4.0.0 to 4.7.8. The exploit uses a crafted HTTP request to trigger an SSRF via the 'auth[server]' parameter, redirecting the server to an attacker-controlled endpoint.
Description
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
Exploits (4)
This repository contains a functional exploit for CVE-2021-21311, an SSRF vulnerability in Adminer versions 4.0.0 to 4.7.8. The exploit uses a crafted HTTP request to trigger an SSRF via the 'auth[server]' parameter, redirecting the server to an attacker-controlled endpoint.
This repository is a security-hardened fork of the Adminer WordPress plugin, specifically addressing CVE-2021-21311 (SSRF vulnerability). It includes detailed technical documentation on the vulnerability, mitigation strategies, and security hardening measures implemented.
This repository contains a functional exploit for CVE-2021-21311, an SSRF vulnerability in Adminer. The exploit sets up an HTTP server to capture SSRF responses and crafts a malicious request to trigger the vulnerability.
This repository contains a functional exploit for CVE-2021-21311, an SSRF vulnerability in Adminer. The exploit sets up a local HTTP server to capture SSRF responses and crafts a malicious request to the vulnerable Adminer instance to trigger the SSRF.
Nuclei Templates (1)
title:"Login - Adminer" || cpe:"cpe:2.3:a:adminer:adminer" || http.title:"login - adminer"
app="Adminer" && body="4.7.8" || title="login - adminer" || app="adminer" && body="4.7.8"
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N