phpMyAdmin remote PHP code injection vulnerability_PHP tutorial

WBOY
Release: 2016-07-13 17:08:56
Original
1289 people have browsed it

Involved programs:
phpMyAdmin
Description:
phpMyAdmin remote PHP code injection vulnerability
 
Details:
phpMyAdmin is a free tool that provides a WWW management interface for managing MySQL.
phpMyAdmin has a PHP code injection problem. Remote attackers can use this eval() function to execute arbitrary PHP commands.
However, this vulnerability only works when the $cfg[‘LeftFrameLight‘] variable (config.inc.php file) is set to FALSE.
phpMyAdmin stores multiple server configurations in the ($cfg['Servers'][$i]) array variable. These configurations are included in the config.inc.php file. The information includes host, port, user, password, and verification. Type, etc., but since $cfg['Servers'][$i] has not been initialized, remote users are allowed to add server configuration through the GET function, such as submitting the following request to add configuration:
http://target/phpMyAdmin-2.5 .7/left.php?server=4&cfg[Servers][host]=202.81.x.x&cfg[Servers][port]=8888&cfg[Servers][user]=alice ..
And The $eval_string string in the eval() function allows the execution of PHP code. An attacker can increase the server configuration and submit a specially constructed table name, which can cause the contained malicious PHP code to be executed.
Affected systems:
phpMyAdmin phpMyAdmin 2.5.7
 
Attack method:
No effective attack code yet
 
Solution:
Current manufacturer No patches or upgrades have been provided yet. We recommend that users of this software always pay attention to the manufacturer's homepage to obtain the latest version:
http://www.phpmyadmin.net

www.bkjia.comtruehttp: //www.bkjia.com/PHPjc/629810.htmlTechArticleInvolved program: phpMyAdmin Description: phpMyAdmin remote PHP code injection vulnerabilitynbsp; Details: phpMyAdmin is a free tool for management MySQL provides a WWW management interface. phpMyAdm...
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template
About us Disclaimer Sitemap
php.cn:Public welfare online PHP training,Help PHP learners grow quickly!