0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion Vulnerability
[The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip The problem appears in /index.php Find 55~63 lines Line 61 contains include $_REQUEST['target']; This is obviously LFI precursor, as long as we bypass the 55 to 59 restrictions on the line Line 57 restricts the target parameter from beginning with index Line 58 limit target parameter cannot appear within $target_blacklist Find the definition of $target_blacklist : In /index.php the first of 50 lines As long as the target parameter is not import.php or export.php, the last limit is Core::checkPageValidity($_REQUEST['target']) Find the checkPageValidity method of the Core class : Defined in the \ libraries \ classes \ core.php on the 443 line The problem is in urldecode() on line 465 We can use this function to bypass the white list detection! I ? Twice url encoded as % 253f can bypass the validation! Payload: http://127.0.0.1/phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../windows/wininit.ini - - - I thought the loophole was over, because I didn't find out where phpmyadmin could perform file operations to implement Getshell . After several weeks of inspiration, I thought of a way to get Shell without writing files . We all know that after login phpmyadmin , the database is completely controllable, then we can write the WebShell to the database and then include the database file? Tested locally, I found that if you use WebShell as the field value of the data table can be perfectly written to the database file: Find the corresponding database file: Include: Payload: http://127.0.0.1/phpmyadmin/index.php?a=phpinfo();&target=db_sql.php%253f/../../../../../../phpStudy/PHPTutorial/MySQL/data/hack/hack.frm # 0day.today [2024-12-24] #