CVE-2026-96634: 
PHP vulnerability analysis and mitigation

CVE-2026-96634 is a patch bypass vulnerability in AdminNeo's SQLite functionality that enables authenticated remote code execution via catastrophic regex backtracking. It affects adminneo-org/adminneo versions prior to 5.5.1 and is classified as a bypass of the original CVE-2021-43008 fix. The vulnerability was discovered by 0daystolive (Sorcery Ltd) working with the TrendAI Zero Day Initiative, first published on July 20, 2026, and added to the GitHub Advisory Database on October 30, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, AdminNeo Advisory).

The root cause is an incorrect return value check on PHP's preg_match() function (CWE-74: Injection). The patch for CVE-2021-43008 introduced a regex filter in admin/sql.inc.php to block SQLite ATTACH statements: preg_match("~^$space*+ATTACH\b~i", $q, $match). The $space pattern includes SQLite comment syntax (--), and the possessive quantifier *+ causes catastrophic backtracking when the input contains approximately 350,000 -- comment lines. When PHP's backtracking limit is exceeded, preg_match() returns false rather than 0 or 1; because the code only checks for a truthy result (treating false the same as 0/no match), the ATTACH filter is silently bypassed and the malicious query is passed to Connection::get()->multiQuery($q) (Github Advisory, AdminNeo Advisory). The fix changes the check to !== 0 to correctly distinguish a regex error (false) from a non-match (0) (Patch Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary PHP code on the server by creating a .php file via a crafted SQLite ATTACH statement. The attacker can then access the created file over HTTP to achieve full remote code execution, potentially leading to complete server compromise, data exfiltration, and lateral movement within the hosting environment. The primary impact is on integrity and availability of the vulnerable system, with confidentiality risks arising from subsequent post-exploitation activity (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires authentication to AdminNeo, which limits the attacker pool but does not eliminate risk in environments with weak or shared credentials. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available (Github Advisory, AdminNeo Advisory).

1. Authenticate: Log in to an AdminNeo instance (version < 5.5.1) with valid credentials.
2. Select SQLite database: Navigate to the SQLite database management interface within AdminNeo.
3. Craft malicious SQL file: Create a .sql file containing approximately 350,000 SQLite comment lines (--\n) followed by an ATTACH statement that creates a PHP webshell, e.g.:

   --
   --
   ... (350,000 lines)
   ATTACH '/var/www/html/shell.php' AS db; -- with PHP code embedded

4. Upload via SQL import: Use AdminNeo's SQL import form to upload the crafted file. The file content is read into $query without initial sanitization.
5. Trigger backtracking: The query parser processes the file; the preg_match() ATTACH filter encounters the massive comment block, exceeds PHP's backtracking limit, and returns false, bypassing the security check.
6. Execute ATTACH: The malicious ATTACH statement is passed to multiQuery(), creating a PHP file at the attacker-specified path on the server.
7. Access webshell: Send an HTTP request to the newly created PHP file to execute arbitrary commands on the server (Github Advisory, AdminNeo Advisory).

• Network: HTTP POST requests to the AdminNeo SQL import endpoint (?import or equivalent) with unusually large payloads (multi-megabyte .sql files); subsequent HTTP GET requests to unexpected .php files in the web root.
• File System: Newly created .php files in the web server document root or AdminNeo installation directory not associated with legitimate deployments; files containing PHP code such as <?php system($_GET[...]) ?> or similar webshell patterns.
• Logs: Web server access logs showing large POST requests to the AdminNeo import handler followed shortly by GET requests to previously non-existent .php files; PHP error logs showing preg_match(): Backtrack limit exhausted warnings in sql.inc.php.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget) following access to newly created PHP files (Github Advisory).

Upgrade adminneo-org/adminneo to version 5.5.1 or later, which corrects the preg_match() return value check from a truthy comparison to !== 0, ensuring that a backtracking failure is not silently treated as a non-match (Patch Commit, Release v5.5.1). As an interim measure, restrict access to AdminNeo to trusted IP addresses and enforce strong authentication to reduce the risk of exploitation by unauthorized users. Disabling SQLite support in AdminNeo, if not required, would also eliminate the attack surface.

The vulnerability was discovered by 0daystolive (Sorcery Ltd) in coordination with the TrendAI Zero Day Initiative (ZDI), which follows a responsible disclosure model and provided vendor notification before public release (AdminNeo Advisory). No significant broader media coverage or notable community commentary beyond the advisory and patch release has been identified at this time.