.. / CVE-2021-21311

Exploit for Adminer < 4.7.9 - Server-Side Request Forgery (CVE-2021-21311)

Description:

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Proof of Concept

PoC exploit

Nuclei Template

View the template here CVE-2021-21311.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-21311.yaml
Copy

Try the exploit in a lab environment:

Lab Machine Link
Hack The Box AdmirerToo Go to Practice

References:

https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf
https://nvd.nist.gov/vuln/detail/CVE-2021-21311
https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6
https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351
https://packagist.org/packages/vrana/adminer