To be fair, nowadays phpmyadmin is mostly only good for escalating privileges, not obtaining them in the first place. I don't think they've had a serious pre-auth flaw in a while.
In most cases it wasn't even PHPMyAdmin's fault per se, but the people not taking 5 minutes to harden it or upgrade it. In many cases, no offence to the makers of this tool, finding a phpmyadmin instance (especially not up-to-date) was a tell tale sign of trouble ahead. Phpmyadmin has caused trouble for people you can't even begin to imagine (ok you probably can). Oh the memories.
Comments
When I was a security auditor, finding a PHPMyAdmin instance would make my day. Somehow, the customer would not share in my joy. How peculiar.
To be fair, nowadays phpmyadmin is mostly only good for escalating privileges, not obtaining them in the first place. I don't think they've had a serious pre-auth flaw in a while.
In most cases it wasn't even PHPMyAdmin's fault per se, but the people not taking 5 minutes to harden it or upgrade it. In many cases, no offence to the makers of this tool, finding a phpmyadmin instance (especially not up-to-date) was a tell tale sign of trouble ahead. Phpmyadmin has caused trouble for people you can't even begin to imagine (ok you probably can). Oh the memories.