POST /phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../etc/passwd
User must have FILE privilege; file must be readable by MySQL process. phpmyadmin hacktricks verified
Metasploit module exploit/linux/mysql/mysql_udf_payload automates this for MySQL < 5.1, but modern versions require manual patch. POST /phpmyadmin/index
Last verified against: MySQL 8.0.36, MariaDB 10.11, phpMyAdmin 5.2.1 (March 2025 threat landscape). phpMyAdmin 5.2.1 (March 2025 threat landscape).