PhpMyAdmin 4.8.1 Remote File Inclusion

Manieendar Mohan
Published on
16 Jun 2021

phpMyAdmin is a free PHP-based software tool for managing MySQL over the Network. A vulnerability in phpMyAdmin 4.8.x prior to 4.8.2 was discovered. CVE-2018–12613 was allocated to a file inclusion flaw found in index.php from PMA 4.8.0 and 4.8.1. It is triggered by a validation bypass in the insecure route checking feature Core::checkPageValidity.phpMyAdmin directives such as $cfg[‘AllowArbitraryServer’] = true or $cfg[‘ServerDefault’] = 0 cannot be used on vulnerable applications because An authenticated remote attacker will exploit this flaw to execute arbitrary PHP code on the server by bypassing login requirement without any authentication.

Mitigation / Precaution

  • When PHP is configured with a restrictive ‘open_basedir’, an attacker’s right to access files on the server is significantly restricted.
  • Maintain the most recent version of PhpMyAdmin.
Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Manieendar Mohan
Manieendar Mohan
Cyber Security Lead Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment