Phpmyadmin Hacktricks Verified Patched Jun 2026

If secure_file_priv prevents INTO OUTFILE , you can manipulate the global MySQL logs to write a PHP payload into a file within the web directory.

If you have administrative access (e.g., root credentials), the most direct verified method is writing a PHP shell to the web root using the SELECT ... INTO OUTFILE command.

Include the session file (typically /var/lib/php/sessions/sess_ ) via the vulnerable parameter. 🔍 Discovery and Foothold

This previously mentioned vulnerability (CVE-2018-12613) is a powerful example of moving from Local File Inclusion (LFI) to RCE. After logging in, an attacker can create a new table where a field name contains PHP backdoor code. By locating the physical file path of the table (e.g., hack.frm ) and including it via the LFI vulnerability, they can execute arbitrary PHP code and write a persistent web shell to the server. phpmyadmin hacktricks verified

This comprehensive guide covers the enumeration, exploitation, and post-exploitation vectors for phpMyAdmin, mirroring the structured methodology found in the HackTricks repository. 1. Initial Enumeration & Footprinting

A flaw in the page filtering utility allows an authenticated attacker to include arbitrary files from the server. By executing a specific SQL query, the payload is written to the database session file. The attacker then includes that session file to trigger code execution. Exploit Payload Example:

: The config.inc.php file is a primary target. If an attacker gains read access to this file, they can extract the blowfish_secret used for cookie encryption or find hardcoded database credentials. Post-Exploitation and Data Exfiltration If secure_file_priv prevents INTO OUTFILE , you can

SELECT '' INTO OUTFILE '/var/www/html/shell.php'; Use code with caution.

Successful exploitation begins with thorough discovery. You must identify the software version, configuration flaws, and accessible endpoints. Version Detection

phpMyAdmin is one of the most widely deployed web interfaces for managing MySQL and MariaDB databases. Because it sits directly in front of critical data, misconfigurations or unpatched vulnerabilities frequently make it a primary target for security auditors and attackers alike. By locating the physical file path of the table (e

The famous CVE-2018-12613 is a Local File Inclusion vulnerability that could be exploited in older phpMyAdmin versions (4.8.0, 4.8.0.1, 4.8.1).

A flaw in the page filtering and redirection logic allows authenticated users to include arbitrary files via the target parameter. Exploitation Steps:

The information contained in this post is for educational purposes only. The author and publisher disclaim any liability for any damages or losses resulting from the use of this information. Use this information at your own risk.