CVE-2026-100695 in Adminer
Summary
by MITRE • 09/26/2026
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in Adminer versions prior to 6.0.2 represents a critical intersection of client-side scripting flaws and backend database misconfigurations, culminating in Remote Code Execution (RCE). At its core, this is an Unescaped Output leading to Cross-Site Scripting (CWE-79) within the context of a specialized administrative tool. The flaw manifests when Adminer processes results from specific SQL queries, particularly those invoking the CONNECTION_ID() function. Instead of properly sanitizing or escaping these values before embedding them into JavaScript code blocks on the client side, the application interpolates the raw database output directly. This lack of input validation allows an attacker who controls the data source to inject malicious script payloads that are subsequently executed by the victim's browser within the trusted origin context of Adminer.
The operational impact is severe because it bypasses standard same-origin policy protections when combined with specific server-side capabilities. While cross-site scripting typically requires social engineering or a compromised third-party resource, this vulnerability leverages trust in the database layer itself. If an attacker has access to a malicious database instance that can be queried by Adminer, they can manipulate the return value of CONNECTION_ID() to include executable JavaScript code. When the authenticated user interacts with Adminer, their browser executes this injected script under the authority of the Adminer application. This effectively turns the administrative interface into a vehicle for client-side attacks against the administrator's session and cookies.
The severity escalates significantly in co-located deployment scenarios where the database server possesses FILE privileges and has write access to the webroot directory. In such environments, the XSS vulnerability serves as an initial foothold that enables further exploitation through SQL injection techniques facilitated by the executed JavaScript. The malicious script can programmatically submit authenticated SQL requests back to the Adminer interface or directly interact with the backend via API calls if available. By leveraging these automated requests, an attacker can execute commands such as INTO DUMPFILE or SELECT ... INTO OUTFILE. These MySQL-specific features allow for writing arbitrary data from database tables into files on the server's file system.
By carefully crafting SQL statements within the injected script, attackers can write PHP code directly to a location accessible by the web server. This results in Remote Code Execution (CWE-94) as the web server interprets and runs the uploaded PHP file with its own privileges. The attacker gains full control over the application environment, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network. This attack path highlights the danger of combining client-side vulnerabilities with powerful backend database features that have broad filesystem permissions.
Mitigation strategies must address both the immediate code flaw and the underlying configuration risks. The primary remediation is upgrading Adminer to version 6.0.2 or later, where this specific interpolation issue has been patched through proper output encoding. For environments unable to upgrade immediately, implementing strict Content Security Policy (CSP) headers can help mitigate XSS impacts by restricting script execution sources and preventing inline scripts from running without nonces or hashes. Additionally, database administrators should adhere to the principle of least privilege by revoking FILE privileges for accounts used in web applications whenever possible. If file write access is strictly necessary, it should be restricted to temporary directories that are not accessible via HTTP requests, thereby neutralizing the INTO DUMPFILE attack vector even if XSS occurs. Regular security audits and static code analysis tools can also help identify similar patterns of unescaped output interpolation in custom administrative interfaces.