adminneo-org/adminneo

vulnerable: v4.10.0 ... v5.4.1 (40 versions)

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter become…

vulnerable: v4.10.0 ... v5.5.0 (53 versions)

AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery ### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask…

vulnerable: v4.10.0 ... v5.5.0 (53 versions)

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) ## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a databas…

vulnerable: v4.10.0 ... v5.5.0 (43 versions)

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers ### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP he…

vulnerable: v4.10.0 ... v5.5.0 (53 versions)

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) ## Summary AdminNeo inserts the database server's version string into a `<script>` tag that carries a valid CSP nonce, without any sanitization. A rogue …

vulnerable: v4.10.0 ... v5.5.0 (53 versions)

AdminNeo SQLite Database-List Drop Arbitrary File Deletion ## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver valida…

vulnerable: v4.10.0 ... v5.5.0 (53 versions)

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE ### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQL…