1

I was looking into a phpMyAdmin security vulnerability (CVE-2018–12613) and the best write-up of it doesn't explain a very crucial technical detail.

It just says: "index.php runs include 'sql.php?/../../etc/passwd', and PHP has this magic to convert the path to ../etc/passwd, without checking if the directory sql.php? exists or not. "

Can anyone help me understand this? https://medium.com/@happyholic1203/phpmyadmin-4-8-0-4-8-1-remote-code-execution-257bcc146f8e

The php manual has some info about this, for example John Carty wrote how you can inject some code using your own website, but that doesn't explain my case. https://www.php.net/manual/en/function.include.php

When i wrote the following line into my own apache2 laravel php server:

include('../../../etc/passwd');

Then I got the contents of etc/passwd on my page, but writing 

include('sql.php?../../../etc/passwd');

or 

include('index.php?../../../etc/passwd');

do nothing. What am I missing?

The result be that the include command:

include 'sql.php?/../../etc/passwd'

only includes '../../../etc/passwd'

Paku
  • 455
  • 1
  • 4
  • 15
  • @miken32 The next best write-up is in chinese :D https://blog.vulnspy.com/2018/06/21/phpMyAdmin-4-8-x-LFI-Exploit/ Of course that string is from the URL, but why shouldn't it work the same when hardcoded into php? – Paku May 01 '19 at 14:57
  • After re-reading this, try `include('sql.php?../../../../etc/passwd');`. `sql.php?` is seen as a directory so you need an extra `../` to go up. – AbraCadaver May 01 '19 at 14:57
  • @AdraCadaver The amount (3) of ../ is correct for my installation. And the proposed include('sql.php?../../../../etc/passwd'); didn't work either – Paku May 01 '19 at 14:58
  • @AdraCadaver You are absolutely correct! 'include('sql.php?/../../../../etc/passwd');' worked! I needed an extra /../ so that sql.php? be considered a directory. – Paku May 01 '19 at 15:02

1 Answers1

0
include('sql.php?/../../../../etc/passwd');

worked! I needed an extra /../ so that sql.php? be considered a directory. The "magic" of the include command is that it allows you to go into nonexistant directories and then come out of them.

Barmar
  • 741,623
  • 53
  • 500
  • 612
Paku
  • 455
  • 1
  • 4
  • 15