CVE-2018-12613

This exploit targets a vulnerability in phpMyAdmin 4.8.0 and 4.8.1, allowing remote code execution by leveraging a session file inclusion flaw. It authenticates, injects a malicious query, and triggers execution via a crafted URL.

This Metasploit module exploits CVE-2018-12613, an authenticated local file inclusion vulnerability in phpMyAdmin 4.8.0 and 4.8.1, leading to remote code execution via crafted database queries and session file inclusion.

This exploit leverages a Local File Inclusion (LFI) vulnerability in phpMyAdmin 4.8.0/4.8.1 to achieve Remote Code Execution (RCE) by including a session file containing malicious PHP code. The attacker first injects PHP code via an SQL query, then includes the session file through a crafted URL.

This exploit leverages a Local File Inclusion (LFI) vulnerability in phpMyAdmin 4.8.1 via a double URL-encoded payload to bypass input validation. It demonstrates reading arbitrary files and suggests a method to achieve remote code execution by including a database file containing malicious PHP code.

This PowerShell script exploits a Local File Inclusion (LFI) vulnerability in PHPMyAdmin v4.8.0 and v4.8.1 by leveraging a filter bypass using the %253f character. It crafts an HTTP request with authenticated cookies to retrieve arbitrary files from the remote server.

This is a Python 3 port of the CVE-2018-12613 exploit for phpMyAdmin 4.8.0/4.8.1, which allows arbitrary file read and PHP code execution via path traversal and SQL injection. The PoC includes authentication checks and version validation.

This repository contains a writeup in Chinese discussing a file inclusion vulnerability in phpMyAdmin 4.8.1 (CVE-2018-12613). It describes the vulnerability's configuration, principles, and reproduction steps but does not include exploit code.

This repository contains a functional exploit for CVE-2018-12613, targeting phpMyAdmin 4.8.1 with a Python-based RCE exploit and a reverse shell generator. It also includes a privilege escalation exploit for CVE-2023-2640 and detailed documentation.

This Metasploit module exploits an authenticated local file inclusion (LFI) vulnerability in phpMyAdmin 4.8.0 and 4.8.1 to achieve remote code execution (RCE) by creating a malicious database table and including it via path traversal.