CVE-2023-45197

CVSS V2 None CVSS V3 None

Description

The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the root of the Adminer directory. The attacker can effectively guess the name of the uploaded file and execute it. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.3.

Overview

CVE ID
CVE-2023-45197

Assigner
cisa-cg

Vulnerability Status
PUBLISHED

Published Version
2024-06-21T14:28:36.476Z

Last Modified Date
2024-06-21T16:14:14.814Z

Weakness Enumerations

CWE	URL
CWE-434	http://cwe.mitre.org/data/definitions/434.html
CWE-22	http://cwe.mitre.org/data/definitions/22.html

References

Reference URL	Reference Tags
https://github.com/adminerevo/adminerevo/commit/1cc06d6a1005fd833fa009701badd5641627a1d4	patch

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-45197
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45197

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 10:26:53				Added to TrackCVE