GHSA-97h7-mf38-g9mf: 
PHP vulnerability analysis and mitigation

Adminer, a popular PHP tool for MySQL and PostgreSQL database administration, contained a file disclosure vulnerability affecting versions 4.3.1 through 4.6.2. The vulnerability was discovered in June 2018 and allows attackers to access arbitrary files on systems running vulnerable versions of Adminer (GitHub Advisory, Sansec Research).

The vulnerability stems from a protocol flaw in MySQL that could be exploited through Adminer's external connection feature. The issue has been assigned a CVSS v3.1 score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is tracked as CWE-200, indicating an information disclosure issue (GitHub Advisory).

When exploited, this vulnerability allows attackers to fetch sensitive files from the victim's system, including configuration files containing database credentials for popular applications like Magento and WordPress. Once obtained, these credentials can be used to gain unauthorized access to the site's database, potentially leading to data theft or malicious code injection (Sansec Research).

The exploitation occurs in three stages: first, attackers set up a modified MySQL server designed to send data import requests to connecting clients; second, they locate an accessible adminer.php file on the target system; and finally, they use the obtained credentials to access the victim's database. Multiple Magecart factions were observed exploiting this vulnerability in the wild since October 2018, suggesting that the modified MySQL server exploit may have been available on the dark web (Sansec Research).

The vulnerability was patched in Adminer version 4.6.3, released in June 2018. Users are strongly advised to upgrade to version 4.7.0 or later. Additionally, it is recommended to protect database tools with additional password protection and/or IP filtering to prevent unauthorized access (Sansec Research, GitHub Commit).