⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2018-12613 — Improper Authentication in Phpmyadmin
Severity
8.8HIGHNVD
EPSS
94.3%
top 0.06%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJun 21
Latest updateMay 13
Description
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) an…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
3💥Exploits & PoCs
6📋Vendor Advisories
1Debian▶
CVE-2018-12613: phpmyadmin - An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker c...↗2018
🕵️Threat Intelligence
1📄Research Papers
1arXiv▶
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks↗2019-05-29