CVE-2026-25892

Executive Summary

CVE-2026-25892 is a high-severity (CVSS 7.5) unauthenticated persistent denial-of-service (DoS) vulnerability affecting Adminer versions 4.6.2 through 5.4.1. The flaw resides in the version check endpoint (?script=version), which lacks origin validation for incoming POST data. An attacker can send a crafted POST request with a version[] parameter, causing PHP to convert it into an array. On the next page load, openssl_verify() receives this array instead of a string, triggering a TypeError and returning an HTTP 500 error to all users. This effectively renders the Adminer interface unusable until the server is restarted or the error is manually cleared. No authentication is required, and the attack can be executed remotely over the network.

Supply Chain & Package Security

Adminer is a single-file PHP application commonly deployed via direct download or package managers like Composer. The vulnerability affects the core adminer.php file. Users who installed Adminer via Composer should update to version 5.4.2 or later. The official GitHub repository has released a patch commit, and the maintainer has published a security advisory (GHSA-q4f2-39gr-45jh). No known malicious packages have been identified in the supply chain, but users should verify the integrity of their Adminer installation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no privileges, and results in a persistent denial of service affecting all users. The EPSS score is 0.04297 (0.88907 percentile), indicating active scanning in the wild.

Deep Dive & Mechanics

The vulnerability exists in the version check mechanism of Adminer. The intended flow is:

1. Adminer loads and sends a request to adminer.org to check for updates.
2. adminer.org responds with a signed version string via JavaScript postMessage.
3. The browser then POSTs this version string to the local endpoint ?script=version.
4. The server validates the signature using openssl_verify().

The flaw is that the ?script=version endpoint does not validate the Origin header of the POST request. An attacker can craft a POST request from any origin (e.g., a malicious website or a direct HTTP request) and send a version[] parameter. PHP interprets the [] suffix as an array assignment, converting the parameter into an array. When the server processes this on the next page load, openssl_verify() expects a string but receives an array, causing a TypeError that is not caught. This results in an unhandled exception, returning an HTTP 500 error for all subsequent requests.

The attack is persistent because the malformed data is stored in the session or processed on every page load until the server is restarted or the session is cleared. The vulnerability affects all Adminer versions from 4.6.2 to 5.4.1 inclusive.

Vulnerable vs. Patched Code

Vulnerable Code (Adminer <= 5.4.1):

// In the version check handler
$version = $_POST['version']; // No type check or origin validation
$signature = $_POST['signature'];
if (openssl_verify($version, $signature, $public_key)) {
    // Process version
}

Patched Code (Adminer 5.4.2):

// In the version check handler
$version = $_POST['version'];
$signature = $_POST['signature'];
// Validate that $version is a string
if (is_string($version) && is_string($signature)) {
    if (openssl_verify($version, $signature, $public_key)) {
        // Process version
    }
} else {
    // Reject invalid input
    header('HTTP/1.1 400 Bad Request');
    exit;
}

The patch adds type checking (is_string()) to ensure $version and $signature are strings before passing them to openssl_verify(). Additionally, origin validation should be implemented to restrict POST requests to trusted sources.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Adminer 4.6.2 to 5.4.1.
• Network access to the target.

Exploit Steps:

1. Identify the Adminer endpoint (e.g., /adminer.php).
2. Send a crafted POST request to ?script=version with the version[] parameter.

Example Exploit (cURL):

curl -X POST http://target.com/adminer.php?script=version \
  -d "version[]=malicious&signature=ignored"

Expected Outcome: The server returns HTTP 500 on subsequent requests to any Adminer page, causing a denial of service for all users.

Nuclei Template (Provided):

id: CVE-2026-25892

info:
  name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS
  author: DhiyaneshDk
  severity: high
  description: |
    Adminer <= 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges.
  impact: |
    Attackers can cause server errors resulting in denial of service for all users.
  remediation: Upgrade to Adminer 5.4.2 or later.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cwe-id: CWE-20
    epss-score: 0.04297
    epss-percentile: 0.88907
  reference:
    - https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh
    - https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3
  metadata:
    verified: true
    max-request: 3
    vendor: adminer
    product: adminer
    fofa-query: 'title="Adminer" || body="Adminer"'
    shodan-query: 'http.title:"Adminer"'
  tags: cve,cve2026,adminer,passive

http:
  - method: GET
    path:
      - '{{BaseURL}}/adminer.php'
      - '{{BaseURL}}/editor.php'
      - '{{BaseURL}}/adminer/'

    headers:
      Accept-Language: en-US,en;q=0.5
    stop-at-first-match: true

    redirects: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '<span class="version">([0-9.]+)'
          - 'amp;version=([0-9.]+)'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Adminer</title>"
          - "Adminer</a>"
        condition: or

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - 'compare_versions(version, ">=4.6.2", "<=5.4.1")'

Blue Team

Detection Steps:

1. Monitor web server logs for POST requests to ?script=version with unusual parameters (e.g., version[]).
2. Check for HTTP 500 errors on Adminer pages that persist after a single request.
3. Use the provided YARA and Sigma rules to detect exploitation attempts.

Mitigation Steps:

1. Immediately upgrade to Adminer 5.4.2 or later.
2. If upgrade is not possible, implement a WAF rule to block POST requests to ?script=version with array parameters.
3. Restrict access to Adminer endpoints using network-level controls (e.g., VPN, IP whitelisting).
4. Monitor for anomalous traffic patterns targeting Adminer.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /adminer.php?script=version with version[] parameter.
  • HTTP 500 responses on Adminer pages after a successful POST to the version check endpoint.
• File IOCs:
  • Adminer version file (if present) showing version 5.4.1 or earlier.
• Log IOCs:
  • PHP error logs containing TypeError: openssl_verify(): Argument #1 ($data) must be of type string, array given.
  • Web server access logs showing POST to ?script=version with version[] in the request body.

Detection Engineering

YARA Rule

rule CVE_2026_25892_Adminer_DoS {
    meta:
        description = "Detects Adminer version check endpoint exploitation attempt"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-25892"
        severity = "high"
    strings:
        $post_param = "version[]="
        $endpoint = "script=version"
    condition:
        $post_param and $endpoint
}

Sigma Rule

title: Adminer Version Check DoS Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to Adminer version check endpoint with array parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25892
    - https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'script=version'
        cs-uri-query|contains: 'version[]='
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-25892 Adminer Version Check DoS Exploitation"; flow:to_server; content:"POST"; http_method; content:"script=version"; http_uri; content:"version[]="; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Adminer to version 5.4.2 or later.
2. If upgrade is not possible, apply the following workaround:
   • Add a WAF rule to block POST requests to ?script=version with array parameters.
   • Implement origin validation in the version check endpoint (e.g., check Origin header).
3. Restrict network access to Adminer endpoints using firewall rules or VPN.

Long-Term Actions:

1. Regularly update Adminer to the latest version.
2. Conduct security reviews of all exposed web applications.
3. Implement input validation and type checking for all user-supplied data.
4. Monitor for similar vulnerabilities in other PHP applications.

Patch Details:

• Upgrade to Adminer 5.4.2.
• Commit: https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3

Valters IT
Securing Digital Frontiers

{/* [Security Hash: DFCAB95D414D188C4AEAB2E1] */}