Phpmyadmin Hacktricks Now

Mastering phpMyAdmin: A Comprehensive Guide to Exploitation, Bypasses, and Privilege Escalation (HackTricks Style)

Introduction

phpMyAdmin is the world’s most popular MySQL/MariaDB administration tool. While it is a godsend for database administrators, it is a prime target for penetration testers. Misconfigurations, default installations, weak credentials, and outdated versions often turn it into the "golden key" that leads to Remote Code Execution (RCE), privilege escalation, and full server compromise.

1.3 Setup Page (Critical Misconfiguration)

Some installations forget to remove /setup. Check: /phpmyadmin/setup/ If accessible, you can configure the server, which may lead to RCE (more in Part 3). phpmyadmin hacktricks

Part 6: Defenses (For Blue Teams)

If you’re hardening phpMyAdmin:

3. Uploading Files via SQL Queries

• CVE-2014-8959: Unauthenticated access vulnerability.
• CVE-2016-5734: SQL injection vulnerability.

Example:

• /phpmyadmin/
• /pma/
• /mysql/
• /db/
• /admin/mysql/
• /phpMyAdmin-4.8.0/ (version-specific paths)