An unauthenticated attacker can cause a denial of service in Adminer by sending a malicious POST request that triggers a server side error.

This vulnerability stems from improper input validation in the version check mechanism, specifically at the ?script=version endpoint. An unauthenticated attacker can submit a crafted POST request containing an array parameter, which causes an unhandled TypeError in the PHP openssl_verify function, resulting in an HTTP 500 error for all users.

Successful exploitation results in a complete denial of service for the database management interface. With a CVSS score of 7.5, this high severity flaw allows remote attackers to disrupt business operations and administrative database access without requiring any prior authentication.

Immediate Action: Update the Adminer installation to version 5.4.2 or later immediately to resolve the input validation flaw.

Proactive Monitoring: Monitor web server error logs for recurrent HTTP 500 status codes specifically associated with the ?script=version endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize POST requests containing unexpected array types to the version check script.

Public Exploit Available: No (only a Nuclei detection template exists).

Given the ease of triggering this denial of service, organizations utilizing Adminer must prioritize upgrading to version 5.4.2. Failure to patch leaves critical database management infrastructure susceptible to service disruption by any remote, unauthenticated actor.