{"id":"CVE-2018-12613","aliases":["EUVD-2022-5695","GHSA-x394-g9j8-x7mf","openSUSE-SU-2024:11171-1"],"status":"published","title":"phpMyAdmin Improper Authentication","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.9835,"percentile":0.99918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287"],"published":"2018-06-21T20:00:00Z","modified":"2026-10-24T10:30:43Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/phpmyadmin_lfi_rce","title":"phpMyAdmin Authenticated Remote Code Execution","type":"exploit","platform":"PHP","date":"2018-06-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/phpmyadmin_lfi_rce"},{"source":"exploitdb","id":"EDB-44924","title":"phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1)","type":"webapps","platform":"php","date":"2018-06-21","verified":true,"url":"https://www.exploit-db.com/exploits/44924"},{"source":"exploitdb","id":"EDB-44928","title":"phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2)","type":"webapps","platform":"php","date":"2018-06-22","verified":true,"url":"https://www.exploit-db.com/exploits/44928"},{"source":"exploitdb","id":"EDB-45020","title":"phpMyAdmin - (Authenticated) Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2018-07-13","verified":true,"url":"https://www.exploit-db.com/exploits/45020"},{"source":"pocgithub","id":"0x00-0x00/CVE-2018-12613","title":"0x00-0x00/CVE-2018-12613","date":"2018-11-09","url":"https://github.com/0x00-0x00/CVE-2018-12613"},{"source":"pocgithub","id":"ivanitlearning/CVE-2018-12613","title":"ivanitlearning/CVE-2018-12613","date":"2019-09-16","url":"https://github.com/ivanitlearning/CVE-2018-12613"},{"source":"pocgithub","id":"eastmountyxz/CVE-2018-12613-phpMyAdmin","title":"eastmountyxz/CVE-2018-12613-phpMyAdmin","date":"2020-02-19","url":"https://github.com/eastmountyxz/CVE-2018-12613-phpMyAdmin"},{"source":"exploitdb","id":"EDB-50457","title":"phpMyAdmin 4.8.1 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2021-10-25","verified":true,"url":"https://www.exploit-db.com/exploits/50457"},{"source":"pocgithub","id":"CyberCTF/vulhub-phpmyadmin-cve-2018-12613","title":"CyberCTF/vulhub-phpmyadmin-cve-2018-12613","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-phpmyadmin-cve-2018-12613"},{"source":"nuclei","id":"CVE-2018-12613","title":"PhpMyAdmin \u003c4.8.2 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-12613.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","fixed_in":["4.8.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8"},{"fixed":"4.8.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpmyadmin/phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8"},{"fixed":"4.8.2"}]}],"versions":["4.8.0","4.8.0.1","4.8.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"phpMyAdmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.2"}]}],"bundled":31}],"products":[{"vendor":"phpmyadmin","product":"phpmyadmin"}],"references":[{"url":"https://www.phpmyadmin.net/security/PMASA-2018-4/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/45020/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.securityfocus.com/bid/104532","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/44924/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.exploit-db.com/exploits/44928/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201904-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12613","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/44924","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/44928","tags":["web"]},{"url":"https://www.exploit-db.com/exploits/45020","tags":["web"]},{"url":"https://www.phpmyadmin.net/security/PMASA-2018-4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x394-g9j8-x7mf"},{"url":"https://github.com/phpmyadmin/composer","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-2869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7260","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5504","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12613","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","status":"published","published":"2018-06-21T20:00:00Z","modified":"2024-08-05T08:38:06.387Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2022-5695","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","status":"published","published":"2018-06-21T20:00:00Z","modified":"2024-08-05T08:38:06Z","updated_at":"2026-11-03T02:39:52.08472Z"}],"ghsa":[{"id":"GHSA-x394-g9j8-x7mf","title":"phpMyAdmin Improper Authentication","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","status":"published","published":"2022-05-13T01:05:22Z","modified":"2024-04-24T17:15:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:45.47408Z"}],"nvd":[{"id":"CVE-2018-12613","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","status":"published","published":"2018-06-21T20:29:00.327Z","modified":"2026-06-17T01:38:03.997Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-12613","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","status":"published","published":"2018-06-21T20:29:00.327Z","modified":"2026-10-24T10:30:43.830458807Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-x394-g9j8-x7mf","title":"phpMyAdmin Improper Authentication","description":"An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).","status":"published","published":"2022-05-13T01:05:22Z","modified":"2024-04-24T17:43:38.520168Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"openSUSE-SU-2024:11171-1","title":"phpMyAdmin-5.1.1-1.2 on GA media","description":"These are all security issues fixed in the phpMyAdmin-5.1.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:16.460481Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}