PHP file inclusion in phpMyAdmin - CVE-2018-12613
Published: June 21, 2018 / Updated: November 25, 2021
Vulnerability identifier: #VU13418
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12613
CWE-ID: CWE-98
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insecure handling of file path before including a php files. A remote authenticated attacker can include and execute arbitrary PHP file from a remote location. This vulnerability can be also exploited by a remote non-authenticated attacker if phpMyAdmin is configured with one of the following options:
- $cfg['AllowArbitraryServer'] = true
- $cfg['ServerDefault'] = 0
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
phpMyAdmin
Gentoo Linux
SUSE Linux
phpmyadmin (Alpine package)
Gentoo Linux
SUSE Linux
phpmyadmin (Alpine package)
How to mitigate CVE-2018-12613
Update to version 4.8.2.
phpMyAdmin - update to 4.8.2
phpmyadmin (Alpine package) - update to 4.8.2-r0
phpmyadmin (Alpine package) - update to 4.8.2-r0
Links to Public Exploits and PoC-codes
- Exploit #7044 - phpMyAdmin 4.8.1 - Remote Code Execution (RCE) (November 25, 2021)
- Exploit #6192 - phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2) (June 17, 2021)
- Exploit #2182 - CVE-2018-12613 (Modified standalone exploit ported for Python 3) (March 18, 2020)
- Exploit #199 - CVE-2018-12613 (PHPMyAdmin v4.8.0 and v.4.8.1 LFI exploit) (March 18, 2020)
- Exploit #200 - CVE-2018-7422 (Wordpress plugin Site-Editor v1.1.1 LFI exploit) (March 18, 2020)
- Exploit #201 - CVE-2018-10517 (CMS Made Simple 2.2.7 RCE exploit) (March 18, 2020)
- Exploit #1763 - phpMyAdmin Authenticated Remote Code Execution (March 18, 2020)