GitHub Advisoryadvisory · Packagist

GHSA-mqh4-2mm8-g7w9 Adminer PHP Object Injection issue leads to Denial of Service

HIGH Published 2025-08-25 Modified 2025-08-25 Official page ↗
Aliases
CVE-2025-43960
Ecosystem
Packagist
Packages
vrana/adminer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-502
Reviewed
2025-08-25

Affected packages

• Packagist vrana/adminer: <= 4.8.1 (no fix yet)

Description

Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using s:1000000000), leading to a PHP Object Injection issue. Remote, unauthenticated attackers can trigger this by sending a malicious serialized object, which forces excessive memory usage, rendering Adminer’s interface unresponsive and causing a server-level DoS. While the server may recover after several minutes, multiple simultaneous requests can cause a complete crash requiring manual intervention.

Related

Alias · CVE (1)

  • CVE-2025-43960 Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g.,… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References