CVE-2026-96634

### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking. Originally reported by @zdi-disclosures in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7 ### Analysis **[Source]** sql.inc.php :: SQL import handler:47 ```php $query = get_file("sql_file", true, ";"); ``` > User uploads a malicious SQL file through the import form. The file content is read into the `$query` variable without any initial sanitization. **[Transform]** sql.inc.php :: SQL import handler:87 ```php // Query parsing loop that extracts individual SQL statements ``` > The uploaded SQL content is processed in a loop that splits it into individual queries. Each query `$query` is extracted for processing. **[Context]** sql.inc.php :: SQL import handler:65 ```php $space = "(?:\\s|/\\*[\s\S]*?\\*/|(?:#|$line_comment)[^\n]*\n?|--\r?\n)"; ``` > Definition of the `$space` regex pattern used in the ATTACH filter. The possessive quantifier `*+` combined with SQLite comment patterns (`--`) creates the catastrophic backtracking vulnerability when many comment lines are processed. **[Transform]** sql.inc.php :: SQL import handler:146 ```php if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) { ``` > The ATTACH query filter check. When the regex encounters 350,000 SQLite comment lines (`--`), it triggers catastrophic backtracking. The possessive quantifier `*+` causes exponential backtracking, eventually hitting PHP's backtracking limit and causing `preg_match()` to return `false` instead of `0` or `1`, bypassing the security filter. **[Sink]**