Description
This module exploits a vulnerability in phpMyAdmin's setup feature which allows an attacker to inject arbitrary PHP code into a configuration file. The original advisory says the vulnerability is present in phpMyAdmin versions 2.11.x <= 2.11.9.4 and 3.x <= 3.1.3.
There was a follow up vulnerability as the patch was incomplete, affecting versions 3.x <= 3.1.3.1.
The file where our payload is written (phpMyAdmin/config/config.inc.php) is not directly used by the system, so it may be a good idea to either delete it or copy the running config (phpMyAdmin/config.inc.php) over it after successful exploitation.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/unix/webapp/phpmyadmin/configmsf undefined(config) > show actions ...actions...msf undefined(config) > set ACTION < action-name >msf undefined(config) > show options ...show and set options...msf undefined(config) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub