Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-3238.
PoCs published by Metasploit, Janek, Vind, Ben Campbell, including Metasploit module exploits/multi/http/phpmyadmin_preg_replace.
AI-analyzed exploit summary This Metasploit module exploits a PREG_REPLACE_EVAL vulnerability in phpMyAdmin (CVE-2013-3238) by leveraging the `replace_prefix_tbl` function to execute arbitrary PHP code. It authenticates with provided credentials, retrieves a CSRF token, and injects payload via the `from_prefix` and `to_prefix` parameters.
Description
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
Exploits (3)
This Metasploit module exploits a PREG_REPLACE_EVAL vulnerability in phpMyAdmin (CVE-2013-3238) by leveraging the `replace_prefix_tbl` function to execute arbitrary PHP code. It authenticates with provided credentials, retrieves a CSRF token, and injects payload via the `from_prefix` and `to_prefix` parameters.
This is a detailed technical writeup describing multiple vulnerabilities in phpMyAdmin, including remote code execution via preg_replace() and local file inclusion. It provides root cause analysis, affected code snippets, and step-by-step exploitation instructions.
This Metasploit module exploits a PREG_REPLACE_EVAL vulnerability in phpMyAdmin (CVE-2013-3238) by leveraging the `preg_replace` function with the `/e` modifier to execute arbitrary PHP code. It authenticates, retrieves a CSRF token, and injects payload via the `replace_prefix_tbl` functionality.