Authenticated RCE via ATTACH filter bypass

Code injection in Adminer Adminer 5.4.2 allows remote authenticated users to execute arbitrary code via crafted SQLite import input. In sql.inc.php, the SQLite ATTACH filter uses preg_match with a regex that can exhaust PHP backtracking on long comment runs; when preg_match returns false, the code treats that error like a non-match and still sends the ATTACH statement to connection()->multi_query(). Exploitation requires an authenticated Adminer session with access to SQLite import functionality, and successful abuse writes a PHP file that runs with web-server privileges when requested.