Threats tagged 'ghsa-wrf7-8p9h-xp6p'

Adminer versions from 5.5.1 through 6.0.1 contain a server-side request forgery (SSRF) vulnerability due to improper parsing of the login 'server' string. This allows a remote unauthenticated attacker to craft a server value that bypasses privileged-port restrictions and causes the server to initiate TCP connections to arbitrary internal hosts and ports before authentication. This vulnerability enables blind internal port scanning and was fixed in version 6.0.2.