Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2018-12613 — PHPMyAdmin v4.8.0 and v.4.8.1 LFI exploit | Kitploit
Tools/GitHubGitHub/0x00-0x00/cve-2018-12613
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHub0x00-0x00/cve-2018-12613

CVE-2018-12613

PHPMyAdmin v4.8.0 and v.4.8.1 LFI exploit

View Repository
107117 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2018-12613

Local file inclusion bug due to filter bypass using %253f character.

Software Affected

  1. PHPMyAdmin v.4.8.0
  2. PHPMyAdmin v.4.8.1

How to use

This PowerShell scripts need three parameters to craft a exploit HTTP request:

root@kitploit:~
1. PHPMyAdmin URL endpoint
2. Cookies for an authenticated user
3. A full path file to be retrieved in remote server

Example

Prepare all the parameters to use the script:

Screenshot

Then, after you run it:

Screenshot

Remote Code Execution

This could lead to remote code execution if you query a SELECT SQL containing PHP code. Then you can include your session file in /var/lib/php/sessions/SESSION_ID_HERE file to execute arbitrary PHP code.

I haven't coded a Code execution PoC. But you can do it manually and trigger it with this code.

Code author: @_zc00l

Download Tool