Adminer CVE-2021-43008 PoC

Proof-of-concept exploit for CVE-2021-43008 affecting Adminer.

This vulnerability allows a malicious MySQL server to request arbitrary local files from the client machine when LOAD DATA LOCAL INFILE is enabled.

The repository contains tools to reproduce the attack.

Repository contents

exploit.py
Python script that automates interaction with Adminer.

Features:

• authenticates to Adminer
• extracts CSRF token
• sends SQL queries
• triggers LOAD DATA LOCAL INFILE
• parses returned file contents

setup_mysql_server.sh
Helper script that prepares a malicious MySQL/MariaDB server for exploitation.

The script:

• configures MariaDB to listen on a custom port
• enables local_infile
• creates a database and user
• prepares the environment for exploitation

Requirements

Python 3.x

Libraries: requests beautifulsoup4 lxml

Usage

Run the setup script:

sudo ./script.sh <IP> <PORT>