Phpmyadmin 4.9.5 Exploit: Fixed
He scanned the access logs. His coffee turned cold.
“They’re not gone. They’re just hiding better.”
POST /phpmyadmin/index.php?route=/server/status/advisor HTTP/1.1" 200 POST /phpmyadmin/index.php?route=/server/status/advisor HTTP/1.1" 200 POST /phpmyadmin/index.php?route=/server/status/advisor HTTP/1.1" 200 Hundreds of times. Over the last week.
But in the back of his mind, a question lingered. The attacker didn’t deface the site. Didn’t steal credit cards. Just… lived there. Watching. Waiting.
Marco hated late-night calls.
He patched the server again. Then he changed every password—including his own.
Marco’s stomach dropped. He checked the database user table. Someone had added a new entry: web_backup with a wildcard host % . The password hash was unfamiliar. The attacker had already backdoored the database.
