CVE-2023-45197: The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The…

PriorityP260critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.66%

47.1th percentile

The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
adminer	adminer	<= *	—
adminer	adminer	cpe:2.3:a:adminer:adminer:0:::::::* – cpe:2.3:a:adminer:adminer::::::::	—
adminerevo	adminerevo	< 4.8.3	4.8.3
adminerevo	adminerevo	>= 4.8.2 < 4.8.3	4.8.3
adminerevo	adminerevo	>= cpe:2.3:a:adminerevo:adminerevo:0:::::::* < cpe:2.3:a:adminerevo:adminerevo:4.8.3:::::::*	cpe:2.3:a:adminerevo:adminerevo:4.8.3:::::::*

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.