PT-2018-11267 · Phpmyadmin+4 · Phpmyadmin+4

William Desportes · Published 2018-06-21 · Updated 2024-06-15 · CVE-2018-12581

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions prior to 4.8.2

Description A Cross-Site Scripting issue has been found where an attacker can use a crafted database name to trigger an attack when that database is referenced from the Designer feature. The issue is related to the js/designer/move.js file.

Recommendations For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Designer feature until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2018-1925

CVE-2018-12581

GHSA-VXJ6-PM6R-23HQ

MGASA-2018-0304

OPENSUSE-SU-2018_1806-1

OPENSUSE-SU-2024:11171-1

USN-4843-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Phpmyadmin

References · 123

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/phpmyadmin_lfi_rce.rb · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2018-12613 · Exploit
• 🔥 https://github.com/ivanitlearning/CVE-2018-12613 · Exploit
• https://ubuntu.com/security/CVE-2014-9218 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4843-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6609 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000014 · Security Note
• https://ubuntu.com/security/CVE-2020-26934 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6609 · Security Note
• https://advisories.mageia.org/MGASA-2018-0304.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18264 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9849 · Security Note
• https://bdu.fstec.ru/vul/2018-01545 · Security Note
• https://phpmyadmin.net/security/PMASA-2018-3 · Vendor Advisory