Adminer 1.12.0-4.6.2 - Arbitrary File Read via Remote MySQL Database Connection
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2021-43008. PoCs published by p0dalirius, Bamolitho, DaturaSaturated.
AI-analyzed exploit summary This PoC exploits CVE-2021-43008, a local file read vulnerability in Adminer via SQL injection using the 'LOAD DATA LOCAL INFILE' feature. It authenticates to Adminer, executes arbitrary SQL queries, and reads local files by truncating a table and loading file contents into it.
Description
Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Exploits (3)
This PoC exploits CVE-2021-43008, a local file read vulnerability in Adminer via SQL injection using the 'LOAD DATA LOCAL INFILE' feature. It authenticates to Adminer, executes arbitrary SQL queries, and reads local files by truncating a table and loading file contents into it.
This PoC demonstrates CVE-2021-43008, an arbitrary file read vulnerability in Adminer ≤ 4.6.2 via a rogue MySQL server exploiting the LOAD DATA LOCAL INFILE command.
This PoC exploits CVE-2021-43008, an SQL injection vulnerability in Adminer, by leveraging the 'LOAD DATA LOCAL INFILE' feature to read arbitrary files from the server. The exploit includes a setup script to configure a MySQL server for testing.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N