AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

• < 5.5.1

### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking. Originally reported by @zdi-disclosures in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7 ### Analysis **[Source]** sql.inc.php :: SQL import handler:47 ```php $query = get_file("sql_file", true, ";"); ``` > User uploads a malicious SQL file through the import form. The file content is read into the `$query` variable without any initial sanitization. **[Transform]** sql.inc.php :: SQL import handler:87 ```php // Query parsing loop that extracts individual SQL statements ``` > The uploaded SQL content is processed in a loop that splits it into individual queries. Each query `$query` is extracted for processing. **[Context]** sql.inc.php :: SQL import handler:65 ```php $space = "(?:\\s

GitHub Advisory Database

• ECOSYSTEM: introduced 0; fixed 5.5.1

### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking. Originally reported by @zdi-disclosures in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7 ### Analysis **[Source]** sql.inc.php :: SQL import handler:47 ```php $query = get_file("sql_file", true, ";"); ``` > User uploads a malicious SQL file through the import form. The file content is read into the `$query` variable without any initial sanitization. **[Transform]** sql.inc.php :: SQL import handler:87 ```php // Query parsing loop that extracts individual SQL statements ``` > The uploaded SQL content is processed in a loop that splits it into individual queries. Each query `$query` is extracted for processing. **[Context]** sql.inc.php :: SQL import handler:65 ```php $space = "(?:\\s

GitHub Advisory Database via OSV