{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/adminer--4.7.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.1,"id":"CVE-2020-35572"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Adminer (\u003c= 4.7.8)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Adminer"],"content_html":"\u003cp\u003eCVE-2020-35572 allows an unauthenticated attacker to perform arbitrary file reads on the server hosting Adminer. By forcing the Adminer application to connect to a rogue MySQL server controlled by the attacker, the application can be instructed to execute the 'LOAD DATA LOCAL INFILE' command, exfiltrating contents of arbitrary files from the target filesystem to the attacker's database. A functional proof-of-concept exploit module has been identified and linked to the Kittysploit framework.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initializes a rogue MySQL server accessible from the target Adminer host.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the target Adminer instance (e.g., /adminer.php).\u003c/li\u003e\n\u003cli\u003eAttacker triggers a connection from the target Adminer instance to the rogue MySQL server by submitting the rogue server address in the 'auth[server]' field via a POST request.\u003c/li\u003e\n\u003cli\u003eAdminer performs a handshake with the rogue MySQL server.\u003c/li\u003e\n\u003cli\u003eAttacker observes the connection and obtains the SQL token required for subsequent administrative operations.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request containing a malicious SQL query: 'LOAD DATA LOCAL INFILE \u0026quot;[path]\u0026quot; INTO TABLE [table]'.\u003c/li\u003e\n\u003cli\u003eAdminer reads the file from its local filesystem and transmits the content to the rogue MySQL server.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves the exfiltrated data by querying the rogue MySQL database.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive files (e.g., /etc/passwd or configuration files) from the server hosting the vulnerable Adminer instance, potentially leading to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Adminer to a version beyond 4.7.8 immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not possible, restrict access to the Adminer interface to trusted IP addresses using firewall rules or web server access control lists.\u003c/li\u003e\n\u003cli\u003eDisable the 'LOAD DATA LOCAL' functionality in the MySQL client configuration on the server if not required.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected outbound network connections initiated by the web server service account.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T21:06:03Z","date_published":"2026-10-26T21:06:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-adminer-file-read/","summary":"Adminer versions 4.7.8 and earlier are vulnerable to an arbitrary file read via a rogue MySQL server connection that facilitates the LOAD DATA LOCAL INFILE command.","title":"Adminer: Arbitrary file read via rogue MySQL server (CVE-2020-35572)","url":"https://feed.craftedsignal.io/briefs/2026-10-adminer-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Adminer (\u003c= 4.7.8)","version":"https://jsonfeed.org/version/1.1"}