Loading vulnerability…
CVE-2018-12613 is a local file inclusion (LFI) vulnerability in phpMyAdmin versions 4.8.0 and 4.8.1, arising from improper authentication and insufficient whitelisting of pages during redirection and loading. The flaw allows authenticated attackers to include arbitrary files on the server, and in certain configurations (such as $cfg['AllowArbitraryServer'] = true or $cfg['ServerDefault'] = 0), the vulnerability can be exploited without authentication. Attackers can leverage this to include session files containing injected PHP code, resulting in remote code execution (RCE). The vulnerability is present in the index.php file, specifically due to improper validation of the 'target' parameter, and can be exploited using crafted URLs.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository is a small standalone PoC/lab for CVE-2018-12613 in phpMyAdmin, demonstrating unauthenticated local file inclusion/path traversal leading to arbitrary file read. The repo contains 6 files: a Python exploit (poc.py), a Bash exploit (poc.sh), a docker-compose lab definition, two sample target files (flag.txt and secret.conf), and a detailed README. The main exploit capability is remote retrieval of arbitrary files from a vulnerable phpMyAdmin instance by sending crafted GET requests to index.php with traversal sequences in parameters such as target=db_structure.php&server=../../../... . The Python PoC is the most complete implementation: it checks service availability, tries multiple endpoint/parameter combinations, and prints retrieved content from test files. The Bash PoC performs the same attack flow with curl. The docker-compose file builds a reproducible environment with MySQL 5.7 and phpMyAdmin exposed on localhost:8080, and mounts /var/www/html/flag.txt and /var/www/html/secret.conf into the container so the LFI can demonstrate disclosure. No code execution or shell payload is present; the exploit is focused on file disclosure only. Overall, this is a valid operational PoC for a web/network attack against vulnerable phpMyAdmin deployments.
This repository contains a single Metasploit module (modules/exploits/multi/http/phpmyadmin_lfi_rce.rb) that exploits an authenticated local file inclusion (LFI) vulnerability (CVE-2018-12613) in phpMyAdmin versions 4.8.0 and 4.8.1. The exploit requires valid phpMyAdmin credentials and targets the web interface, typically at /phpmyadmin/. The module authenticates to phpMyAdmin, creates a database and table with a malicious PHP payload, determines the data directory, and then uses a crafted LFI request to include a session or table file containing the payload, resulting in remote code execution as the web server user. The exploit is operational and provides the attacker with the ability to execute arbitrary PHP code on the target server. The code is written in Ruby and is designed to be used within the Metasploit framework.
This repository is a Python-based web vulnerability scanner named Cerberus. It is designed to automate the detection of a wide range of web application vulnerabilities, including SQL injection, XSS, command injection, file inclusion, and SSRF. The tool supports both single-target and batch scanning (via file input or subdomain enumeration), and can also collect and use proxy IPs to bypass WAFs or IP bans. It features middleware fingerprinting and targeted exploitation for specific platforms (ThinkPHP, phpMyAdmin, Tomcat, Weblogic, Wordpress, Dedecms), with hardcoded exploits for known CVEs (e.g., CVE-2018-5955, CVE-2018-12613, CVE-2018-11759). The scanner can detect WAFs and attempt known bypasses, and it generates scan reports. The main entry point is 'cerberus.py', which orchestrates scanning based on command-line arguments. The codebase is modular, with core logic for payload management, proxy handling, subdomain brute-forcing, and vulnerability exploitation. Numerous endpoints are fingerprinted, including public proxy sources, file paths for LFI/RFI, and SSRF targets. The repository is operational and suitable for real-world vulnerability assessment of web applications.
This repository contains a Python 3 exploit script (CVE-2018-12613.py) targeting phpMyAdmin versions 4.8.0 and 4.8.1 on Linux systems. The exploit leverages a local file inclusion vulnerability to execute arbitrary PHP code on the target server. The script authenticates to phpMyAdmin using supplied credentials, verifies the version is vulnerable, and then performs directory traversal to confirm the server is Linux-based. It then injects a user-supplied PHP payload (such as a reverse shell) via a crafted SQL query and retrieves the output from the server's PHP session files. The result of the payload execution is saved locally as 'result.html'. The README provides usage instructions and demonstrates how to use a msfvenom-generated PHP reverse shell payload. The main attack vector is network-based, exploiting the phpMyAdmin web interface via HTTP requests. The repository is structured with a single exploit script and a README, and is operational, requiring only valid credentials and a vulnerable target to achieve code execution.
This repository contains a PowerShell proof-of-concept exploit for CVE-2018-12613, a local file inclusion (LFI) vulnerability in PHPMyAdmin versions 4.8.0 and 4.8.1. The main script, PHPMyAdmin-LFI.ps1, takes three parameters: the target PHPMyAdmin URL, authenticated session cookies, and the path to a file to retrieve from the server. It constructs a specially crafted HTTP request that exploits the LFI vulnerability to read arbitrary files, such as /etc/passwd, from the remote server. The README provides usage instructions and notes that, while the script does not directly provide remote code execution, such an outcome is possible if the attacker can include a file containing PHP code (e.g., a session file). The repository is structured simply, with the main exploit script, a README, a license, and a .gitattributes file. The exploit requires authenticated access to the target PHPMyAdmin instance.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.