CVE-2023-45196 is a high severity denial of service flaw in Adminer and AdminerEvo, scored 7.5. The record says AdminerEvo 4.8.4 fixes it and that Adminer is unsupported. The AdminerEvo project is now archived, so plan to move to a maintained tool and keep any copy off public networks.
What's affected
The NVD record says an unauthenticated remote attacker can cause a denial of service by getting Adminer or AdminerEvo to connect to an attacker-controlled service that answers with HTTP redirects. The effect is subject to PHP configuration limits. The record was published on 2024-06-24.
NVD scores it 7.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, a network attack with no privileges and a high availability impact.
The record says Adminer is no longer supported, and that the issue was fixed in AdminerEvo version 4.8.4. The only reference is a commit inside pull request 102 on the AdminerEvo repository, titled "Disable redirections in HTTP based drivers". The pull request page I loaded shows the request as closed, and I could not confirm from it that the change shipped in 4.8.4. Verify the fix in the release you use.
The AdminerEvo repository is archived and read-only as of 24 January 2025, so no further fixes should be expected from it.
Weakness class: CWE-400 (uncontrolled resource consumption).
How to check if you're exposed
Find out whether Adminer or AdminerEvo is deployed. It is a single PHP file, often named adminer.php, so search your web roots and container images:
find / -iname "adminer*.php" 2>/dev/null
The version is printed on the login page footer and at the top of the file. Anything older than AdminerEvo 4.8.4 is in range, and any build of the original Adminer is described as unsupported by the record.
What to do now
- Search servers, containers and shared hosting accounts for adminer files and record the version.
- Remove Adminer from any host where it is not needed. It should not sit on production web roots.
- If you must keep it, restrict access by network address or put it behind a VPN and authentication.
- Move to an actively maintained database tool, since AdminerEvo is archived.
- Set PHP execution time and memory limits, which the record says bound the impact.
Why it matters
The weakness is uncontrolled resource consumption, tracked as CWE-400. Here the tool follows HTTP redirects from a server it connects to, and a server that redirects forever ties up the process. PHP limits end each request in the end, which is why the impact has limits, but repeated requests can still hurt a small host.
Database admin tools are commonly left on servers after setup. They draw attention from scanners because their login pages are easy to find. The project status is the larger issue: with the project archived, you cannot count on a fixed release if another bug appears. CVE-2023-45196 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Safeguard's free in-browser dependency scan can show if an Adminer package is part of a project you ship.
Quick check
Which version fixes CVE-2023-45196?
The record says AdminerEvo 4.8.4. I could not confirm that from the pull request page, so verify it in your build.
Is Adminer itself fixed?
No. The record says Adminer is no longer supported.
Sources
Last reviewed: 19 October 2026.
