{"id":"CVE-2018-12613","published":"2018-06-21T20:00:00Z","modified":"2024-08-05T08:38:06Z","title":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","provenance":"source","from":"CVE.org"},"summary":{"text":"An issue in phpMyAdmin 4.8.x before 4.8.2 lets an attacker include and potentially execute files on the server, because the code that redirects and loads pages inside phpMyAdmin improperly checks whitelisted pages. Exploitation normally requires an authenticated session, but the flaw can be reached without authentication when the configuration sets ServerDefault to 0 (bypassing the login requirement), and it can lead to arbitrary code execution when AllowArbitraryServer is enabled and the attacker controls a host they can specify.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:42Z"},"cvss":null,"epss":{"score":0.9835,"percentile":0.99918,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-12-06","exploitedFirstSeen":"2022-12-06","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities","date":"2022-12-06"},{"url":"https://blog.netlab.360.com/new-ddos-botnet-wszeor/","date":"2022-12-07"},{"url":"https://t.me/hacking_Attack/79492","date":"2022-12-08"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation","date":"2022-12-22"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"DDoS Botnet, ZeroBot, Adds to its Capabilities","url":"https://otx.alienvault.com/pulse/63ac9a9b47285cdeaac87628","created":"2022-12-28"},{"name":"Microsoft research uncovers new Zerobot capabilities","url":"https://otx.alienvault.com/pulse/63a97aca4939331148964839","created":"2022-12-26"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a5bd9e4b819d29d7b8f94c","created":"2022-12-23"},{"name":"Microsoft research uncovers new Zerobot capabilities","url":"https://otx.alienvault.com/pulse/63a5ae13d4a3401905954b4a","created":"2022-12-23"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a5366d09707e5927d950b9","created":"2022-12-23"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a4721874292cc0afb8a687","created":"2022-12-22"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a41dfc05aa84684084441f","created":"2022-12-22"},{"name":"Dozens of IoT vulnerabilities exploited by new Go – based Zerobot botnet","url":"https://otx.alienvault.com/pulse/63909251ac70341084ecf17e","created":"2022-12-07"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2018-4/","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/45020/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.securityfocus.com/bid/104532","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.exploit-db.com/exploits/44924/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.exploit-db.com/exploits/44928/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://security.gentoo.org/glsa/201904-16","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"TRAM2 annotated sentence label","mappingType":null,"evidence":[{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow","start":4486,"end":4784},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files.","start":4548,"end":4824}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute","start":4548,"end":4817}]}],"affected":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","vulnerableRanges":[">=4.8, <4.8.2"],"patched":["4.8.2"],"from":["GHSA-x394-g9j8-x7mf"],"provenance":"source"}],"advisories":[{"id":"GHSA-x394-g9j8-x7mf","url":"https://github.com/advisories/GHSA-x394-g9j8-x7mf","severity":"HIGH","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","vulnerableRanges":[">=4.8, <4.8.2"],"patched":["4.8.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-5695","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5695","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":44924,"url":"https://www.exploit-db.com/exploits/44924","title":"phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1)","type":"webapps","platform":"php","date":"2018-06-21","verified":true,"provenance":"source"},{"id":44928,"url":"https://www.exploit-db.com/exploits/44928","title":"phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2)","type":"webapps","platform":"php","date":"2018-06-22","verified":true,"provenance":"source"},{"id":45020,"url":"https://www.exploit-db.com/exploits/45020","title":"phpMyAdmin - (Authenticated) Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2018-07-13","verified":true,"provenance":"source"},{"id":45020,"url":"https://www.exploit-db.com/exploits/45020","title":"phpMyAdmin - (Authenticated) Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2018-07-13","verified":true,"provenance":"source"},{"id":50457,"url":"https://www.exploit-db.com/exploits/50457","title":"phpMyAdmin 4.8.1 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2021-10-25","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":5,"earliest":"2018-06-21"},"pocGithub":{"count":4,"skipped":0,"earliest":"2018-11-09","earliestUrl":"https://github.com/0x00-0x00/CVE-2018-12613","repos":[{"name":"0x00-0x00/CVE-2018-12613","url":"https://github.com/0x00-0x00/CVE-2018-12613","stars":10,"created":"2018-11-09"},{"name":"ivanitlearning/CVE-2018-12613","url":"https://github.com/ivanitlearning/CVE-2018-12613","stars":4,"created":"2019-09-16"},{"name":"eastmountyxz/CVE-2018-12613-phpMyAdmin","url":"https://github.com/eastmountyxz/CVE-2018-12613-phpMyAdmin","stars":2,"created":"2020-02-19"},{"name":"CyberCTF/vulhub-phpmyadmin-cve-2018-12613","url":"https://github.com/CyberCTF/vulhub-phpmyadmin-cve-2018-12613","stars":0,"created":"2026-10-08"}]},"metasploit":[{"name":"phpMyAdmin Authenticated Remote Code Execution","module":"exploit/multi/http/phpmyadmin_lfi_rce","type":"exploit","disclosureDate":"2018-06-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb"}],"nuclei":[{"id":"CVE-2018-12613","name":"PhpMyAdmin <4.8.2 - Local File Inclusion","severity":"high","path":"http/cves/2018/CVE-2018-12613.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12613.yaml"}],"first":{"date":"2018-06-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/45020/","https://www.exploit-db.com/exploits/44924/","https://www.exploit-db.com/exploits/44928/","http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/44924","https://www.exploit-db.com/exploits/44928","https://www.exploit-db.com/exploits/45020"],"flow":[{"stage":"observed","techniques":["T1190"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2018-06-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2018-06-21, PoC-in-GitHub 2018-11-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb","provenance":"source"},{"date":"2018-06-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-12613","provenance":"source"},{"date":"2022-12-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1423 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 5 Exploit-DB entries; 1 NVD exploit link; 3 advisory exploit references; 4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-7260","published":"2018-02-21","fixed":"4.7.8","kev":false},{"cve":"CVE-2018-10188","published":"2018-04-19","fixed":"4.8.0.1","kev":false,"link":{"from":"CVE-2018-10188","to":"CVE-2018-12613","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.8.0.1","toFixed":"4.8.2","daysApart":63}]}},{"cve":"CVE-2018-12581","published":"2018-06-21","fixed":"4.8.2","kev":false},{"cve":"CVE-2018-12613","published":"2018-06-21","fixed":"4.8.2","kev":false},{"cve":"CVE-2018-15605","published":"2018-08-24","fixed":"4.8.3","kev":false,"link":{"from":"CVE-2018-12613","to":"CVE-2018-15605","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:phpmyadmin/phpmyadmin","fromFixed":"4.8.2","toFixed":"4.8.3","daysApart":64}]}},{"cve":"CVE-2018-19968","published":"2018-12-11","fixed":"4.8.4","kev":false},{"cve":"CVE-2018-19969","published":"2018-12-11","fixed":"4.8.4","kev":false}],"package":"Packagist:phpmyadmin/phpmyadmin"}}