phpMyAdmin < 2.11.5 SQL Injection

[Lyecdevf]

It is a variable that was not cleaned in a way, allowing you to inject SQL code into the cookie. Here is a example of a small vulnerable php script.
Code:

Code: Select all

<?php
$user['id'] = $_COOKIE['uid']; 
$query = "SELECT name, password FROM members where uid='" . $user['id'] . "'";
$query = mysql_query($query);
$name = mysql_result($query, 0);
echo 'Hello ' . $name . '!';
?>

If it is a normal user, it would display a perfectly good name like "Hello Admin!".
You can now use a thing such the extention for firefox called Cookie Editor, and modify the cookie, you can also do this with javascript.
You then edit the cookie's value, it would have been something like "12", but after editing and adding sql code to it, it would be something like "-1 UNION ALL SELECT USER(), NULL FROM mysql.user--".
That will change the query, and display the user connected to the database, instead of the name of the user stored in the database.
That will result in the following being echo'd; "Hello root@localhost".

http://secunia.com/advisories/29200/

[bad_brain]

well, phpmyadmin is generally a spot that is attacked a LOT...let it run in the default place (http://www.yourdomain.com/phpmyadmin/) and you can see how the logs fill with loads of automated login attempts. best is to remove it completely and use mysql/mysqladmin directly in the shell, or, if there are customers on the server that need this feature, to use a cryptic alias in the webserver config:

Code: Select all

Alias /whatever /var/www/phpmyadmin

[tharakanuwanpro]

I don't understand how to do it . Please Tell me how to do it step by step

[ayu]

Just telling you how to do it wont teach you anything useful...

Learn what PHP is and how it works, and WHY the sites are vulnerable and why the exploit works like they do....

Just by learning PHP you will understand a lot of it much clearer...

[shell_admin]

Just telling you how to do it wont teach you anything useful...

Learn what PHP is and how it works, and WHY the sites are vulnerable and why the exploit works like they do....

Just by learning PHP you will understand a lot of it much clearer...

[Gogeta70]

Shell_admin, simply quoting what somebody says is as bad as spam in a way. It's useless, and quite frankly, it's as irritating as somebody standing next to you repeating everything you say.