Chaining PHP2Shell — A Deep Dive into Expl

The security topic of Chaining PHP2Shell refers to chaining vulnerabilities that ultimately allow remote code execution, often resulting in a web shell like PHP2Shell on a compromised server. One critical example involves CVE-2018-12613, an arbitrary file inclusion vulnerability affecting phpMyAdmin. This vulnerability permits an attacker to include local files and execute arbitrary PHP code. It carries a CVSS v3.0 Base Score of 9.8 (Critical), reflecting its severe impact. Affected versions include phpMyAdmin 4.8.0 and 4.8.1.

Chaining PHP2Shell: A Technical Deep Dive

The root cause of CVE-2018-12613 lies within the `setup/index.php` script of phpMyAdmin. This script handles the initial configuration of phpMyAdmin, including server setup and the creation of the `config.inc.php` file. The vulnerability stems from insufficient sanitization of the `target` parameter. This parameter controls which file is included or processed. Attackers can manipulate it to perform directory traversal and include arbitrary local files. This bypasses security checks and allows for unintended file access and execution.

Exploitation of this vulnerability begins with an attacker crafting a malicious configuration. They send a POST request to `setup/index.php` to initiate a new server configuration. During this process, they inject malicious PHP code into a configuration field, such as the 'host' parameter. This injected code is then written to the `config.inc.php` file, which phpMyAdmin stores on the server. The lack of proper input validation allows this code injection to occur without immediate detection.

After injecting the malicious code into `config.inc.php`, the attacker initiates a second request to `setup/index.php`. This request leverages the vulnerable `target` parameter. The attacker uses directory traversal sequences (e.g., `../../`) to point the `target` parameter to the newly created `config.inc.php` file. When phpMyAdmin attempts to include this file based on the manipulated `target` value, the embedded malicious PHP code executes. This grants the attacker remote code execution capabilities, effectively deploying a PHP2Shell or similar web shell.

Detecting this vulnerability requires specific checks. System administrators must verify their phpMyAdmin version. Any installation running phpMyAdmin 4.8.0 or 4.8.1 is vulnerable. Organizations should regularly scan their web applications for known vulnerabilities. A free website vulnerability scanner can identify outdated software versions and potential configuration flaws. For more specific checks, a CMS vulnerability scanner can target phpMyAdmin installations directly. Furthermore, monitoring file system integrity, especially for files like `config.inc.php`, helps detect unauthorized modifications. Tools like Zondex assist in identifying publicly exposed phpMyAdmin instances across the internet, highlighting potential targets for attackers.

Remediation for CVE-2018-12613 is straightforward: update phpMyAdmin to a patched version. Version 4.8.2 and later releases contain the fix for this arbitrary file inclusion vulnerability. Administrators should also restrict access to the `setup.php` script when not in use. This prevents attackers from initiating the configuration process required for exploitation. Implementing a Web Application Firewall (WAF) helps filter malicious requests, blocking attempts to manipulate parameters like `target` with directory traversal payloads. Regularly reviewing and hardening server configurations also reduces the overall attack surface. Consider reading our blog post on PHP2Shell Explained — Why You Must Patch Now for further insights into securing against web shells.

The timeline of disclosure for CVE-2018-12613 was rapid. Paulos Yibelo discovered and reported the vulnerability to the phpMyAdmin project on June 19, 2018. The phpMyAdmin team addressed the issue quickly, releasing version 4.8.2 with the necessary patch on June 26, 2018. Public disclosure of the vulnerability occurred concurrently with the patch release, giving administrators a short window to update their systems.