CVE-2021-43008

An attacker tricks an Adminer instance (running on a target server) into connecting to a remote MySQL database that the attacker controls. Because Adminer's connection logic does not properly restrict file access, the attacker can issue SQL commands (e.g., `LOAD DATA LOCAL INFILE`) that cause the Adminer server to read arbitrary local files and transmit their contents to the attacker's database server. This exploits the trust Adminer places in the remote database server's responses, combined with missing access controls on the local filesystem [CWE-552].

The vulnerability affects Adminer versions 1.12.0 through 4.6.2. The product is a single-file PHP database management tool that allows connecting to remote databases. The flaw lies in how Adminer handles file access when establishing connections to a remote MySQL database server controlled by an attacker.

The advisory does not include a patch diff. The fix in version 4.6.3 addresses the improper access control by restricting how Adminer handles file operations during database connections. Without the patch source, the specific code changes cannot be detailed, but the remediation prevents the attacker-controlled MySQL server from triggering arbitrary file reads on the Adminer host.