A critical vulnerability in Adminer allows unauthenticated remote code execution due to improper sanitization of server connection parameters.

This is a code injection vulnerability (CWE-73) where the application fails to sanitize the server field before constructing a PDO DSN string. Unauthenticated attackers can inject malicious ODBC parameters, specifically TraceFile and TraceOn, to write files to the server and execute arbitrary PHP code.

The ability for an unauthenticated attacker to execute arbitrary code on the server poses a severe threat to the confidentiality, integrity, and availability of the entire environment. Given the CVSS score of 9.8, this vulnerability is critical and could lead to full system compromise, data exfiltration, or the deployment of ransomware within the network.

Immediate Action: Upgrade to Adminer version 5.4.3 or later to apply the necessary input validation fixes.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing semicolon characters or unusual connection parameters directed at the Adminer interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious DSN connection strings or unexpected file path manipulations.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Adminer must prioritize this update immediately. The lack of authentication requirements for this vulnerability makes it an attractive target for automated scanning and exploitation, necessitating rapid patching to prevent total server compromise.