bugtraq - Re: PHP 5.2.4 <= various mysql functions safemode & open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 12 Sep 2007 13:27:01 +0100
From: Ben Wheeler <b.wheeler@...c.ac.uk>
To: bugtraq@...urityfocus.com
Subject: Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass

On Tue, Sep 11, 2007 at 04:38:47AM -0000, laurent.gaffie@...il.com wrote:
> Application: PHP <=5.2.4
> Web Site: http://php.net
> Platform: unix
> Bug: safemode & open_basedir bypass
...
> various mysql functions safemode & open_basedir bypass
> ( LOAD_FILE , INTO DUMPFILE , INTO OUTFILE )
...
> <?php
> mysql_connect("localhost", "granted_user","something");
> mysql_query("select load_file(0x2F6574632F706173737764)into dumpfile'/test/123.txt';");
> ?>

I don't see what this has to do with PHP. If a user has been granted
the FILE privilege on MySQL, they can create and read files on the server
with the permissions of the mysqld user. That privilege should clearly
not be granted to untrusted users, at least not without using mysqld's 
--secure-file-priv=/some/safe/path option.

Ben