Adminer blocks "ATTACH" queries for SQLite to prevent arbitrary file creation. However, "VACUUM INTO" is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands. Originally reported in Adminer: "GHSA-q4f2-39gr-45jh" (https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf)