phpMyAdmin is a free software tool, written in PHP, designed to handle the administration of MySQL over the Web.
phpMyAdmin before 18.104.22.168 is vulnerable to code injection as a result of failure to sanitize input passed via the
**from_prefix** parameter passed to
**libraries/mult_submits.inc.php**. As a result, an authenticated remote attacker could potentially execute arbitrary code.
Upgrade to phpMyAdmin 22.214.171.124 or newer.
This exploit was tested against phpMyAdmin Devel Team phpMyAdmin 3.5.8 on CentOS 6 (with Exec-Shield Enabled).
Netcat (nc) must be installed on the target.
Exploit requires a valid path to phpMyAdmin and valid user credentials for phpMyAdmin's web interface.
Only phpMyAdmin running on a PHP version before 5.4.7 is vulnerable. Newer PHP versions will generate a warning.