CVE-2018-12613: phpMyAdmin 4.8.x improper whitelist check allows local file inclusion and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityHigh CVSS (8.8), very high EPSS, public exploit code, and a configuration path that bypasses authentication make this an urgent patch target.

What it is

phpMyAdmin 4.8.x before 4.8.2 fails to properly validate which pages may be loaded during internal redirects, letting an attacker include and potentially execute files on the server. The flaw is reachable by an authenticated user, and in specific configurations (AllowArbitraryServer=true or ServerDefault=0) it can be triggered without valid credentials.

Impact

An attacker can read files on the server and, depending on available files and configuration, execute arbitrary code on the phpMyAdmin host. This yields compromise of the database management interface and potentially the underlying web server.

Attack surface

Reached over the network via HTTP requests to the phpMyAdmin web interface; the CVSS vector indicates low privileges are required, but the description notes that ServerDefault=0 bypasses authentication entirely and AllowArbitraryServer=true allows an attacker-controlled host to be specified. No user interaction is required.

Exploitation

Public exploit code exists (Exploit-DB 44924, 44928, 45020 and a Packet Storm RCE writeup), and EPSS is very high at 0.9835 (99.9th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade phpMyAdmin to 4.8.2 or later immediately.
• If upgrade is not possible, restrict network access to phpMyAdmin to trusted administrative networks only.
• Set $cfg['AllowArbitraryServer'] = false and avoid $cfg['ServerDefault'] = 0 to remove the unauthenticated and arbitrary-host paths.
• Enforce strong authentication and least privilege on phpMyAdmin accounts, and remove unused accounts.
• Monitor and restrict the web server user's ability to read sensitive files and execute code.

Detection

• Inspect web server and phpMyAdmin logs for requests to index.php with unusual 'target' parameters or path traversal sequences.
• Alert on POST/GET requests to phpMyAdmin endpoints containing file paths or '..' patterns.
• Monitor for unexpected file reads or process execution by the web server user following phpMyAdmin requests.
• Hunt for known exploit payload patterns from public Exploit-DB entries against phpMyAdmin 4.8.x.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.