admin管理员组文章数量:1130349
I have a freelancer working on a program for me.
I gave him access to the theme folder via FTP. He uploaded phpMiniAdmin to that folder and, somehow, obtained the database credentials, which he then used to sign in.
How did he manage to obtain those credentials? Is there a vulnerability that can be used once you can upload files to the server?
I have a freelancer working on a program for me.
I gave him access to the theme folder via FTP. He uploaded phpMiniAdmin to that folder and, somehow, obtained the database credentials, which he then used to sign in.
How did he manage to obtain those credentials? Is there a vulnerability that can be used once you can upload files to the server?
Share Improve this question edited Dec 31, 2018 at 2:39 That Brazilian Guy 1,2413 gold badges19 silver badges43 bronze badges asked Dec 30, 2018 at 14:34 Dan W.Dan W. 234 bronze badges 02 Answers
Reset to default 7All he needed to do is to put this PHP code in any template file and run it:
var_dump(DB_NAME, DB_USER, DB_PASSWORD, DB_HOST);
One line and it will print all the DB credentials.
As you can see - no vulnerabilities are needed.
All PHP code has access to these credentials. And it has to - otherwise it wouldn’t be able to access DB...
If they can upload files then they can upload a php file that can read the database credentials from wp-config.php. Having upload access to the server can let you do almost anything. Don't give that access to people you don't trust. There's no vulnerability here, you just gave them the keys.
I have a freelancer working on a program for me.
I gave him access to the theme folder via FTP. He uploaded phpMiniAdmin to that folder and, somehow, obtained the database credentials, which he then used to sign in.
How did he manage to obtain those credentials? Is there a vulnerability that can be used once you can upload files to the server?
I have a freelancer working on a program for me.
I gave him access to the theme folder via FTP. He uploaded phpMiniAdmin to that folder and, somehow, obtained the database credentials, which he then used to sign in.
How did he manage to obtain those credentials? Is there a vulnerability that can be used once you can upload files to the server?
Share Improve this question edited Dec 31, 2018 at 2:39 That Brazilian Guy 1,2413 gold badges19 silver badges43 bronze badges asked Dec 30, 2018 at 14:34 Dan W.Dan W. 234 bronze badges 02 Answers
Reset to default 7All he needed to do is to put this PHP code in any template file and run it:
var_dump(DB_NAME, DB_USER, DB_PASSWORD, DB_HOST);
One line and it will print all the DB credentials.
As you can see - no vulnerabilities are needed.
All PHP code has access to these credentials. And it has to - otherwise it wouldn’t be able to access DB...
If they can upload files then they can upload a php file that can read the database credentials from wp-config.php. Having upload access to the server can let you do almost anything. Don't give that access to people you don't trust. There's no vulnerability here, you just gave them the keys.
本文标签： uploadsGet Database Credentials from within the themes file
版权声明：本文标题：uploads - Get Database Credentials from within the themes file 内容由热心网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：https://it.en369.cn/questions/1749057112a2309522.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。
发表评论