CVE-2021-21311

Adminer, a popular single-file PHP database management tool, contains a server-side request forgery vulnerability (CWE-918) in versions 4.0.0 through before 4.7.9 when the deployment bundles all database drivers, such as the standard adminer.php file. An unauthenticated remote attacker can influence the database server address that Adminer connects to, causing the server-side PHP process to issue requests to attacker-chosen internal or external hosts and ports. This can be used to enumerate internal services and, as with other recently exploited SSRF flaws (e.g., the Pandoc attacks against AWS IMDS), to steal cloud instance metadata credentials. Anyone running an affected version, whether standalone or via the Debian adminer package, is exposed. The flaw has an EPSS of 90.5% and was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-29, confirming active exploitation in the wild.

What to do: Upgrade Adminer to version 4.7.9 or later; on Debian, install the current security update for the adminer package. If upgrading is not immediately possible, restrict access to adminer.php (IP allowlisting, authentication, or removing it from the web root) and review logs for connections from the web server to internal services or cloud metadata endpoints such as 169.254.169.254. As a KEV entry, US federal agencies must apply the required mitigations or discontinue use per BOD 22-01 guidance.