Re: phpmyadmin / PMASA-2016-60
Brian May <bam@debian.org> writes:
> Ok, so I have had one more idea since typing this out. Possibly the
> problem is that the user is connecting as something like
> "root\0fudge". This results in the user connecting to mysql as "root" -
> assuming the mysql functions have this vulnerability" but we think the
> user is connecting as "root\0fudge" so the don't apply the rules for
> "root".
Looks like that was it, I can produce under wheezy.
This means for example it is possible to log in as "root%00something"
(were %00 is the null byte, not the encoding) and roots password and
gain root priviledges even if you have configured phpmyadmin not to
allow logins as root.
You still do need the root password however.
--
Brian May <bam@debian.org>
Reply to: