Back to Database
Status published
Critical
CVE-2023-45197
Adminer and AdminerEvo vulnerable to directory traversal and file upload
Vulnerability Description
The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45197
Credits & Attribution
No credits recorded in the NVD database.
References
Affected Vendor
Adminer
View all reports →Affected Software
Adminer, AdminerEvo
Vulnerable Versions:
0, cpe:2.3:a:adminer:adminer:0:*:*:*:*:*:*:*, 4.8.2, cpe:2.3:a:adminerevo:adminerevo:0:*:*:*:*:*:*:*
Timeline
Official Publish:
June 21st, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1505.003
Web Shell
Persistence
T1105
Ingress Tool Transfer
Command and Control
T1059
Command and Scripting Interpreter
Execution
T1565.002
Stored Data Manipulation
Impact
T1005
Data from Local System
Collection
T1552
Unsecured Credentials
Credential Access
T1565.001
Stored Data Manipulation
Impact