CVE-2021-21311— SSRF in adminer
Quick assessment
Affected
vrana adminer
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SOURCEFORGE Adminer是美国SOURCEFORGE社区的一个应用软件。提供单个PHP文件中的数据库管理。 SOURCEFORGE Adminer 中存在代码问题漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Public Exploits 1
Nuclei · 1
CVE-2021-21311.yaml [template]
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-21311
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SSRF in adminer
Source: CVE Program / CVE List V5
Vulnerability Description
Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
SOURCEFORGE Adminer 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SOURCEFORGE Adminer是美国SOURCEFORGE社区的一个应用软件。提供单个PHP文件中的数据库管理。 SOURCEFORGE Adminer 中存在代码问题漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2021-21311
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9. | https://github.com/llhala/CVE-2021-21311 | POC Details |
| 2 | None | https://github.com/omoknooni/CVE-2021-21311 | POC Details |
| 3 | Adminer before 4.7.9 is susceptible to server-side request forgery due to exposure of sensitive information in error messages. Users of Adminer versions bundling all drivers, e.g. adminer.php, are affected. An attacker can possibly obtain this information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21311.yaml | POC Details |
| 4 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Adminer-SSRF%E6%BC%8F%E6%B4%9E%20CVE-2021-21311.md | POC Details |
| 5 | None | https://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/Adminer%20ElasticSearch%20%E5%92%8C%20ClickHouse%20%E9%94%99%E8%AF%AF%E9%A1%B5%E9%9D%A2SSRF%E6%BC%8F%E6%B4%9E%20CVE-2021-21311.md | POC Details |
| 6 | https://github.com/vulhub/vulhub/blob/master/adminer/CVE-2021-21311/README.md | POC Details | |
| 7 | A secure, zero-trust database management tool for WordPress. Fixes critical SSRF vulnerabilities (CVE-2021-21311) by enforcing local connections only. | https://github.com/Sudo-WP/sudowp-adminer | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-21311
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-21311 (1)
Vendor Advisories for CVE-2021-21311 (1)
-
https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6 x_refsource_CONFIRM
Mailing List Discussions for CVE-2021-21311 (1)
Other References for CVE-2021-21311 (2)
-
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf x_refsource_MISC
-
https://packagist.org/packages/vrana/adminer x_refsource_MISC
IV. Related Vulnerabilities
Same product: adminer
-
CVE-2026-56706
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Mask -
CVE-2026-56705
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN -
CVE-2026-56704
Adminer before 5.4.3 Cross-Site Scripting via MySQL Version -
CVE-2026-56703
Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM -
CVE-2026-34968
Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop
Same vendor: vrana
-
CVE-2026-56706
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Mask -
CVE-2026-56705
Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN -
CVE-2026-56704
Adminer before 5.4.3 Cross-Site Scripting via MySQL Version -
CVE-2026-56703
Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM -
CVE-2026-56702
Adminer before 5.4.3 Unrestricted File Upload via AdminerFil
Same weakness: CWE-918
-
CVE-2026-78682
NLTK before 3.10.3 SSRF Protection Bypass via Proxy -
CVE-2026-34964
Adminer before 5.5.0 SSRF via PDO DSN Injection -
CVE-2026-77310
jackson-databind: Eager DNS resolution (SSRF) still present -
CVE-2026-76838
Hi.Events before 1.11.1-beta Server-Side Request Forgery via -
CVE-2026-71366
Awx: notification backends allow ssrf and credential leakage
V. Comments for CVE-2021-21311
No comments yet