Skip to content
OpenAdvisories
High · 8.8 Scanner template Public exploit CVE-2018-12613 EUVD-2022-5695GHSA-x394-g9j8-x7mf

phpMyAdmin Improper Authentication

Published Jun 21, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: phpmyadmin Package: phpmyadmin/phpmyadmin Ecosystem: Alpine Ecosystem: Packagist

Description

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed phpMyAdmin 5.1.1-1.2 openSUSE-SU-2024:11171-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 phpmyadmin 4.8.2-r0 —
Alpine v3.23 phpmyadmin 4.8.2-r0 —
Alpine v3.22 phpmyadmin 4.8.2-r0 —
Alpine v3.21 phpmyadmin 4.8.2-r0 —
Alpine v3.20 phpmyadmin 4.8.2-r0 —
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 phpmyadmin 4.8.2-r0 —
Alpine v3.18 phpmyadmin 4.8.2-r0 —
Alpine v3.17 phpmyadmin 4.8.2-r0 —
Alpine v3.16 phpmyadmin 4.8.2-r0 —
Alpine v3.15 phpmyadmin 4.8.2-r0 —
Alpine v3.14 phpmyadmin 4.8.2-r0 —
Alpine v3.13 phpmyadmin 4.8.2-r0 —
Alpine v3.12 phpmyadmin 4.8.2-r0 —
Alpine v3.11 phpmyadmin 4.8.2-r0 —
Alpine v3.10 phpmyadmin 4.8.2-r0 —
Alpine v3.9 phpmyadmin 4.8.2-r0 —
Alpine v3.8 phpmyadmin 4.8.2-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 4

GitHub 4 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist phpmyadmin/phpmyadmin >= 4.8, < 4.8.2 4.8.2 GHSA-x394-g9j8-x7mf

Advisories 1

References