Published: 21/06/2018 Updated: 02/11/2021

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 670

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

An issue exists in phpMyAdmin 4.8.x prior to 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).

Vulnerable Product	Search on Vulmon	Subscribe to Product
phpmyadmin phpmyadmin

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'phpMyAdmi ...

The latest version downloaded from the official website, the file name is phpMyAdmin-481-all-languageszip The problem appears in /indexphp Find 55~63 lines Line 61 contains include $_REQUEST['target']; This is obviously LFI precursor, as long as we bypass the 55 to 59 restrictions on the line Line 57 restricts the target parameter from beg ...

# Exploit Title: phpMyAdmin 481 - Local File Inclusion to Remote Code Execution # Date: 2018-06-21 # Exploit Author: VulnSpy # Vendor Homepage: wwwphpmyadminnet # Software Link: githubcom/phpmyadmin/phpmyadmin/archive/RELEASE_4_8_1targz # Version: 480, 481 # Tested on: php7 mysql5 # CVE : CVE-2018-12613 1 Run SQL Query : ...

phpMyAdmin version 481 suffers from a local file inclusion vulnerability that can lead to code execution ...

phpMyAdmin version 481 authenticated local file inclusion proof of concept exploits ...

phpMyAdmin version 481 remote code execution exploit ...

一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能

Cerberus 一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安�

Welcome to the Richie Nadeau's Capstone wiki! Project Summary My capstone team and I worked with our Professors, Devin Paden and Joe Eastman, to better the Ethical Hacking course we offer to Cybersecurity students here at Champlain College We found more recent vulnerabilities that teach the same basic concepts, automated their configurations via Ansible, and pushed them o

这篇文章将分享一个phpMyAdmin 4.8.1版本的文件包含漏洞，从配置到原理，再到漏洞复现进行讲解，更重要的是让大家了解这些真实漏洞背后的知识。基础性文章，希望对您有所帮助！

CVE-2018-12613-phpMyAdmin 这篇文章将分享一个phpMyAdmin 481版本的文件包含漏洞，从配置到原理，再到漏洞复现进行讲解，更重要的是让大家了解这些真实漏洞背后的知识。基础性文章，希望对您有所帮助！

typora-root-url: WEB安全\dvwa_list TODO web/JS逆向 adworldxctforgcn/task/answer?type=web&number=3&grade=1&id=4810 ref: st98githubio/diary/posts/2017-10-25-hacklu-ctf-2017html 题目复现护网杯 easy_tornado 1 题目镜像:buuojcn/challenges#easy_tornado 题面如下: # /flagtxt flag in /fllllllllllllag #

Modified standalone exploit ported for Python 3

CVE-2018-12613 Modified standalone exploit ported to Python 3 Tested on Python 373, phpMyAdmin 481 running on Ubuntu 1604 Works on Linux only Original exploit by SSD All credits to them Changes made Added function to exit if provided phpMyAdmin username/password is correct Added function to check if version is vulnerable (480 or 481) Converted variables to either

Project Description Collection of quality safety articles collection-document awesome Table of Contents Github-list 预警&研究 ImageMagick WordPress 杂安全部建设加固响应溯源威胁情报综合 SRC 总结国外SRC文章信息收集渗透靶场技巧内网 hash 票据代理转发内网平台内网收集内网技巧 �

2019年CISCN华南赛区部分web题目备份

2019年CISCN华南赛区部分web题目备份介绍 2019年CISCN华南赛区部分web题目备份时间比较久了，这是fix后的，凭着印象改回原先存在漏洞的版本了 web1~web7为第一天的 web8~web11为第二天的 web2rar是web2的原题目，github无法添加含有git的文件夹，故此打包备份部分提示 web1->RCE web2->SQL

cerberScan 漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿

Capstone Repo

SEC335 Target Generation Overview Summary This project involved myself and my Capstone team assisting one of our professors, Devin Paden in developing and deploying targets for students to attack in the SEC335 Ethical Hacking course offered by Champlian College The goal was to turn the class into one where labs were operated similiarly to a Hack the Box/CTF format in order to

Project Description Collection of quality safety articles collection-document awesome Table of Contents Github-list 预警&研究 ImageMagick WordPress 杂安全部建设加固响应溯源威胁情报综合 Bug_Bounty 总结国外Bug_Bounty文章信息收集渗透靶场技巧内网 hash 票据代理转发内网平台内网收集

记录个人的漏洞复现过程

VULOnceMore 漏洞复现是安全学习的基础漏洞复现最新or经典漏洞原理以及复现，在精不在多。服务器中间件 Redis未授权访问主从复制RCE Docker Apache Tomcat Nginx Nginx解析漏洞 Java Apace Shiro反序列化 550&721 shiro550爆破key原理 FastJson反序列化远程调用注入 Log4j2JNDI注入命�

PHPMyAdmin v4.8.0 and v.4.8.1 LFI exploit

CVE-2018-12613 Local file inclusion bug due to filter bypass using %253f character Software Affected PHPMyAdmin v480 PHPMyAdmin v481 How to use This PowerShell scripts need three parameters to craft a exploit HTTP request: 1 PHPMyAdmin URL endpoint 2 Cookies for an authenticated user 3 A full path file to be retrieved in remote server

CMS Made Simple 2.2.7 RCE exploit

CVE-2018-12613 Authenticated remote command execution by uploading a fake module, dropping PHP files on remote web server Software Affected CMS Made Simple 227; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1 CMS Made Simple URL endpoint; 2 Cookies for unauthenticated user; 2 A command string to be executed in the remote system

Saphire This repository contains the code for our prototype implementation of Saphire, described in our USENIX 2021 Paper Saphire is a mechanism for automatically creating and applying system-call filters for individual scripts in a PHP web-app Here we provide instructions for building Saphire's individual components Additionally, we provide a virtual-disk image

Wordpress plugin Site-Editor v1.1.1 LFI exploit

CVE-2018-12613 Local file inclusion bug due to no sanitization of user input Software Affected Wordpress Plugin: Site-Editor v111; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1 Wordpress URL endpoint 2 A full path file to be retrieved in remote server Example Prepare all the parameters t

CWE-287 https://www.phpmyadmin.net/security/PMASA-2018-4/https://www.exploit-db.com/exploits/44928/http://www.securityfocus.com/bid/104532 https://www.exploit-db.com/exploits/44924/https://www.exploit-db.com/exploits/45020/https://security.gentoo.org/glsa/201904-16 http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html https://nvd.nist.gov https://www.exploit-db.com/exploits/45020/https://github.com/YagamiiLight/Cerberus

Get Started

CVE-2018-12613

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect