Adminer - Security
Adminer has a protection against these attacks: (more information in Czech)
- Cross Site Scripting (XSS)
- SQL injection (except when explicitly allowed, e.g. in SQL query)
- Password Brute Forcing
- Cross-Site Request Forgery (CSRF) (two protections: SameSite cookies and CSRF nonce)
- Server-Side Request Forgery (SSRF)
- Clickjacking
- Session Hijacking
- Session Fixation
- HTTP Response Splitting
- Parameter Injection
- Symlink Traversal
- Retrieve Sensitive Data (passwords used for permanent login are encrypted by a random key)
- Privilege Abuse (log in without password is not allowed)
- Leverage Alternate Encoding
- Remote Code Inclusion
- Referrer Leakage
- Tabnabbing
- Security Through Obscurity
Adminer uses strict Content-Security-Policy (CSP) which adds a second layer of protection against XSS and other attacks. Adminer checks for availability of new version.