Skip to content
Fencer Vulns
high 8.8

CVE-2018-12613 in the critical feed json

phpMyAdmin Improper Authentication

published 2018-06-21 8 y ago modified 2026-06-17 4 mo ago also GHSA-x394-g9j8-x7mf , EUVD-2022-5695

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
98.4%
EPSS 98.4% chance of exploitation in 30 days, percentile 99.9%
public exploits
5
Metasploit, Exploit-DB, plus a Nuclei check

Summary

An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).

Patch / fix

  • packagist phpmyadmin/phpmyadmin 4.8.2
  • phpmyadmin phpmyadmin 4.8.2
  • phpMyAdmin openSUSE Tumbleweed 5.1.1-1.2

opensuse advisories openSUSE-SU-2024:11171-1

  • phpmyadmin Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 4.8.2-r0

alpine advisories ALPINE-CVE-2018-12613

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12613 updated

phpMyAdmin: Multiple security issues fixed in 4.8.4

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/phpmyadmin_lfi_rce)
  2. Published

Exploit prediction

98.35% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/multi/http/phpmyadmin_lfi_rce phpMyAdmin Authenticated Remote Code Execution metasploit exploit, good rank, 2018-06-19
  • EDB-50457 phpMyAdmin 4.8.1 - Remote Code Execution (RCE) webapps, 2021-10-25
  • EDB-45020 phpMyAdmin - (Authenticated) Remote Code Execution (Metasploit) remote, 2018-07-13
  • EDB-44928 phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2) webapps, 2018-06-22
  • EDB-44924 phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1) webapps, 2018-06-21
  • Nuclei template PhpMyAdmin <4.8.2 - Local File Inclusion nuclei detection template
  • packetstormsecurity.com http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
packagist phpmyadmin/phpmyadmin
>=4.8, <4.8.2
4.8.2

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.