[B! phpmyadmin] ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ockeghem id:ockeghem

phpmyadminã«é–¢ã™ã‚‹ockeghemã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

phpMyAdminã‚’ç‹™ã†æ”»æ’ƒãŒå¢—åŠ ã€ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãªã©ã®å¯¾ç–ã‚’ ï¼ ï¼ IT
2012/01/16 2011å¹´ã®å¹´æœ«ã‹ã‚‰2012å¹´ã«ã‹ã‘ã¦ã€phpMyAdminã®è„†å¼±æ€§ã‚’ç‹™ã£ãŸæ”»æ’ƒãŒå¢—åŠ ã—ã¦ãŠã‚Šã€æ³¨æ„ãŒå¿…è¦ã ã€‚ã„ãã¤ã‹ã®ãƒ–ãƒã‚°ã§ã€phpMyAdminã®è„†å¼±æ€§ã‚’ã‚¹ã‚ãƒ£ãƒ³ã—ãŸã¨è¦‹ã‚‰ã‚Œã‚‹ãƒã‚°ãŒå ±å‘Šã•ã‚Œã¦ã„ã‚‹ã€‚ phpMyAdminã¯ã€PHPã§å®Ÿè£…ã•ã‚ŒãŸMySQLã®ç®¡ç†ãƒ„ãƒ¼ãƒ«ã ã€‚æ©Ÿèƒ½ãŒè±Šå¯Œã§ã€Webã‚¤ãƒ³ã‚¿ãƒ¼ãƒ•ã‚§ã‚¤ã‚¹çµŒç”±ã§MySQLã‚’ç®¡ç†ã§ãã‚‹ã“ã¨ã‹ã‚‰åºƒãåˆ©ç”¨ã•ã‚Œã‚‹ä¸€æ–¹ã§ã€è¤‡æ•°ã®è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚Œã¦ãŠã‚Šã€ãŸã³ãŸã³æ”»æ’ƒã®æ¨™çš„ã«ãªã£ã¦ããŸã€‚ å¤ãã¯2009å¹´3æœˆã«ã€ã€ŒphpMyAdminã®setup.phpã«ãŠã‘ã‚‹ä»»æ„ã®PHPã‚³ãƒ¼ãƒ‰ã‚’æŒ¿å…¥ã•ã‚Œã‚‹è„†å¼±æ€§ï¼ˆCVE-2009-1151ï¼‰ã€ãŒç™ºè¦‹ã•ã‚Œã€å¦è¡“æ©Ÿé–¢ã‚’ä¸å¿ƒã«è¢«å®³ãŒç™ºç”Ÿã—ãŸã€‚ ã¾ãŸ2011å¹´7æœˆã«ã‚‚ã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œå¯èƒ½ãª2ç¨®é¡žã®è„†å¼±æ€§ï¼ˆCVE-2011-2505ã€CVE-2011-2506ï¼‰ãŒç™ºè¦‹ã•ã‚Œã¦ã„ã‚‹ã€‚ã“ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹N
ockeghem 2012/01/20
çš†æ§˜ã”æ³¨æ„ã‚’

php

phpmyadmin
ãƒªãƒ³ã‚¯
ã€Œæ³¨æ„å–šèµ·ã€ã®è¨˜äº‹ | ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒ©ãƒƒã‚¯
æ³¨æ„å–šèµ·ã®è¨˜äº‹ ã€Œæ³¨æ„å–šèµ·ã€ã§ã¯ã€ãƒ©ãƒƒã‚¯ãŒæŠŠæ¡ã—ãŸè„†å¼±æ€§ã‚„ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ãªã©ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã«é–¢ã™ã‚‹æƒ…å ±ã‚’ã„ã¡æ—©ãç™ºä¿¡ã—ã¾ã™ã€‚ è§£èª¬ã™ã‚‹ã®ã¯ã€ã‚µã‚¤ãƒãƒ¼æ•‘æ€¥ã‚»ãƒ³ã‚¿ãƒ¼ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç›£è¦–ã‚»ãƒ³ã‚¿ãƒ¼ï¼ˆJSOCï¼‰ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¨ºæ–ãƒãƒ¼ãƒ ãªã©ã®å°‚é–€å®¶ã§ã™ã€‚
ockeghem 2011/12/16
ã€Žâ€»æœ¬æƒ…å ±ã¯ã€HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ å¾³ä¸¸ æµ©æ§˜ã®ãƒ–ãƒã‚°ã‚ˆã‚Šå¼•ç”¨ã‚’ã•ã›ã¦ã„ãŸã ãã¾ã—ãŸã€<è¿½è¨˜ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™

security

phpmyadmin

lac
ãƒªãƒ³ã‚¯
CVE-2009-1151 phpMyAdmin Remote Code Execution Proof of Concept
ockeghem 2011/08/08
php

phpmyadmin

mysql
ãƒªãƒ³ã‚¯
phpMyAdminã«ãŠã‘ã‚‹ä»»æ„ã‚¹ã‚¯ãƒªãƒ—ãƒˆå®Ÿè¡Œå¯èƒ½ãªè„†å¼±æ€§ã®æ¤œè¨¼ - ockeghem's blog
phpMyAdminï¼ˆ3.3.10.2æœªæº€ã€3.4.3.1æœªæº€ï¼‰ã«ã¯ã€ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œå¯èƒ½ãªè„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚ã“ã®ã‚¨ãƒ³ãƒˆãƒªã§ã¯ã€ã“ã®è„†å¼±æ€§ãŒç™ºç”Ÿã™ã‚‹ãƒ¡ã‚«ãƒ‹ã‚ºãƒ ã¨å¯¾ç–ã«ã¤ã„ã¦å ±å‘Šã—ã¾ã™ã€‚ æ¦‚è¦ phpMyAdminã«ã¯ä¸‹è¨˜ã®2ç¨®é¡žã®è„†å¼±æ€§ã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šã€ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ä»»æ„ã®ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å®Ÿè¡Œã•ã›ã‚‰ã‚Œã‚‹è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚ CVE-2011-2505 CVE-2011-2506 è©²å½“ã™ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯ä»¥ä¸‹ã®é€šã‚Šã§ã™ã€‚ phpMyAdmin ãƒãƒ¼ã‚¸ãƒ§ãƒ³3.3.10.2æœªæº€ phpMyAdmin ãƒãƒ¼ã‚¸ãƒ§ãƒ³3.4.3.1æœªæº€ å½±éŸ¿ã‚’å—ã‘ã‚‹æ¡ä»¶ã¯ã€ä¸Šè¨˜ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã®phpMyAdminã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹ã“ã¨ã«åŠ ãˆã¦ã€ä»¥ä¸‹ã‚’ã™ã¹ã¦æº€ãŸã™å ´åˆã§ã™ã€‚ setup/index.phpã¨setup/config.phpã‚’å¤–éƒ¨ã‹ã‚‰å®Ÿè¡Œã§ãã‚‹ phpMyAdminã®configãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãŒå˜åœ¨ã—ã€PHP
ockeghem 2011/08/08
æ—¥è¨˜æ›¸ã„ãŸ

security

php

phpmyadmin

mysql
ãƒªãƒ³ã‚¯
phpMyAdmin 3.x Swekey Remote Code Injection Exploit
<?php /* # Exploit Title: phpMyAdmin 3.x Swekey Remote Code Injection Exploit # Date: 2011-07-09 # Author: Mango of ha.xxor.se # Version: phpMyAdmin < 3.3.10.2 || phpMyAdmin < 3.4.3.1 # CVE : CVE-2011-2505, CVE-2011-2506 # Advisory: http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt # Details: http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html */ echo p
ockeghem 2011/08/06
security

phpmyadmin

vulnerability

exploit
ãƒªãƒ³ã‚¯
1