Re: [phpMyAdmin Developers] How do I determine if versions of phpMyAdmin before 4.8.5 is SQL Injectable using sqlmap?
Isaac Bennetch <[email protected]> Wed, 17 Apr 2019 12:28:27 -0400
| Newsgroups | gmane.comp.php.phpmyadmin.devel |
|---|---|
| Message-ID | <CAFb5Y7pZ=wUcVZBJShdMx0zt-y5sdx1i-JA2N1_1zrBV3nVYeQ@mail.gmail.com> |
SGksCgpUaGFua3MgZm9yIHdyaXRpbmcuIFlvdSd2ZSB0b3VjaGVkIG9uIGEgbG90IG9mIGFyZWFz IGhlcmUgYW5kIEknbGwgdHJ5Cm15IGJlc3QgdG8gYW5zd2VyIHlvdXIgcXVlc3Rpb25zLgoKRm9y IGZpbmRpbmcgb2xkIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdGllcywgdGhlIGJlc3QgcmVzb3VyY2Vz IGFyZSB0aGUKQ2hhbmdlTG9nIChodHRwczovL2dpdGh1Yi5jb20vcGhwbXlhZG1pbi9waHBteWFk bWluL2Jsb2IvbWFzdGVyL0NoYW5nZUxvZwphbmQgaHR0cHM6Ly9naXRodWIuY29tL3BocG15YWRt aW4vaGlzdG9yeS90cmVlL21hc3Rlci9DaGFuZ2VMb2dzKSBhbmQKb3VyIHNlY3VyaXR5IGFubm91 bmNlbWVudHMgcGFnZQooaHR0cHM6Ly93d3cucGhwbXlhZG1pbi5uZXQvc2VjdXJpdHkvKS4KClRo ZSBzcGVjaWZpYyB2dWxuZXJhYmlsaXR5IHdpdGggNC44LjQgaXMgUE1BU0EtMjAxOS0wMgooaHR0 cHM6Ly93d3cucGhwbXlhZG1pbi5uZXQvc2VjdXJpdHkvUE1BU0EtMjAxOS0yLykgd2hpY2ggaXMg aW5kZWVkIGFuClNRTCBpbmplY3Rpb24gdnVsbmVyYWJpbGl0eSBpbiBEZXNpZ25lci4gSWYgSSBy ZW1lbWJlciBjb3JyZWN0bHkgdGhlCmRldGFpbHMgb2YgdGhlIGF0dGFjaywgc3BlY2lhbGx5LWNy YWZ0ZWQgdXNlcm5hbWUgY2FuIGJlIHVzZWQgdG8KZXhwbG9pdCB0aGlzLCBzbyBhbiBhdHRhY2tl ciB3b3VsZCBuZWVkIHRvIGJlIGFibGUgdG8gY3JlYXRlIHRoZQpzcGVjaWFsbHktY3JhZnRlZCB1 c2VybmFtZSB0aHJvdWdoIHNvbWUgZXhwbG9pdCBvZiBzb21lIG90aGVyIHNvZnR3YXJlCm9yIGJ5 IHVzaW5nIGEgdmFsaWQgTXlTUUwgYWNjb3VudCB3aXRoIHByb3BlciBwZXJtaXNzaW9ucy4gVGhl IGF0dGFjawppcyB0aGVuIHRyaWdnZXJlZCBieSBhbiBhdXRob3JpemVkIHVzZXIgYWNjZXNzaW5n IHRoZSBEZXNpZ25lcgpmZWF0dXJlLgoKQWNjZXNzaW5nIHBocE15QWRtaW4gd291bGQgbm9ybWFs bHkgbGVhdmUgYSB0cmFpbCBpbiB0aGUgQXBhY2hlIGFjY2Vzcwpsb2dzLCBzbyBpZiB5b3UgZGlk bid0IHNlZSBhbnl0aGluZyBzdXNwaWNpb3VzIG9yIHJlbGV2YW50IGF0IHRoZSB0aW1lCm9mIGF0 dGFjayBpdCBzZWVtcyBsZXNzIGxpa2VseSB0aGF0IHBocE15QWRtaW4gd291bGQgaGF2ZSBiZWVu IHVzZWQgaW4KdGhlIGF0dGFjay4KCkknbSBub3QgZmFtaWxpYXIgd2l0aCB1c2luZyBzcWxtYXAg aW4gdGhpcyBjYXBhY2l0eSBidXQsIGJhc2VkIG9uIHRoZQphdHRhY2sgdmVjdG9yIG9mIHRoZSBE ZXNpZ25lciBhdHRhY2ssIGFzc3VtZSB0aGF0IHlvdSdkIGhhdmUgdG8gbG9nIGluCndpdGggYSB2 YWxpZCB1c2VyIGFjY291bnQgYW5kIHVzZSB0aGF0IGVzdGFibGlzaGVkIHNlc3Npb24gaW4gdGVz dGluZwp0aGUgZXhwbG9pdC4gSSBjYW4ndCB0aGluayBvZiBhIHdheSB0byBhY3R1YWxseSBkbyB0 aGF0LCB0aG91Z2guCgpBcyBmYXIgYXMgdXNpbmcgYW5kIGNvbmZpZ3VyaW5nIFNub3J0LCB0aGlz IGlzIG5vdCBteSBhcmVhIG9mCmV4cGVydGlzZSBzbyBJJ2xsIHBhc3Mgb24gZ2l2aW5nIGFueSBz cGVjaWZpYyBhZHZpY2UuIE15IHVuZGVyc3RhbmRpbmcKaXMgdGhhdCB5b3UgY2FuIGRldGVjdCBT UUwgaW5qZWN0aW9uIGF0dGFja3MgdXNpbmcgU25vcnQsIHRob3VnaC4KCkkgaG9wZSB0aGlzIGlu Zm9ybWF0aW9uIGlzIG9mIGhlbHAgdG8geW91LApJc2FhYwoKT24gV2VkLCBBcHIgMTcsIDIwMTkg YXQgOTo1OCBBTSBUdXJyaXRvcHNpcyBEb2hybmlpIFRlbyBFbiBNaW5nCjxjZW9AdGVvLWVuLW1p bmctY29ycC5jb20+IHdyb3RlOgo+Cj4gU3ViamVjdC9Ub3BpYzogSG93IGRvIEkgZGV0ZXJtaW5l IGlmIHZlcnNpb25zIG9mIHBocE15QWRtaW4gYmVmb3JlIDQuOC41IGlzIFNRTCBJbmplY3RhYmxl IHVzaW5nIHNxbG1hcD8KPgo+Cj4KPiBHb29kIGV2ZW5pbmcgZnJvbSBTaW5nYXBvcmUsCj4KPgo+ Cj4gT3VyIGN1c3RvbWVyIChjb21wYW55IG5hbWUgaXMgQ29uZmlkZW50aWFsL25vdCBkaXNjbG9z ZWQpIHJlcG9ydGVkIHRoYXQgdGhlaXIgTXlTUUwgZGF0YWJhc2UgaGFzIGJlZW4gZm91bmQgbWlz c2luZyBvciB3YXMgZGVsZXRlZCBhIGZldyB0aW1lcy4gVGhleSBhcmUgdXNpbmcgVWJ1bnR1IDE2 LjA0IExUUyBMaW51eCBzZXJ2ZXIgd2l0aCBBcGFjaGUyIFdlYiBTZXJ2ZXIsIE15U1FMIGFuZCBQ SFAgKExBTVApLgo+Cj4KPgo+IFdlIHJlc3BvbmRlZCB0byB0aGVzZSBzZWN1cml0eSBpbmNpZGVu dHMgYnkgY2hhbmdpbmcgdGhlIHBhc3N3b3JkcyBvZiB0aGUgcmVndWxhciB1c2VyLCByb290IHVz ZXIsIGFuZCBNeVNRTCBkYXRhYmFzZSB1c2VyIHJvb3QuIFdlIGhhdmUgYWxzbyBleGFtaW5lZCAv dmFyL2xvZy9hdXRoLmxvZyBhbmQgdGhpbmsgdGhhdCB0aGUgaGFja2VyIGNvdWxkIG5vdCBoYXZl IGNvbWUgaW4gdGhyb3VnaCBzc2ggb3Igc2Z0cCBvdmVyIHNzaC4gRnJvbSAvdmFyL2xvZy9teXNx bC9lcnJvci5sb2csIHdlIGNhbiBhc2NlcnRhaW4gdGhhdCB0aGUgTXlTUUwgZGF0YWJhc2UgaGFz IGJlZW4gZGVsZXRlZCBhdCBjZXJ0YWluIHRpbWluZ3MuIFdlIGhhdmUgYWxzbyBmb3VuZCBub3Ro aW5nIGFibm9ybWFsIGFmdGVyIGV4YW1pbmluZyAvdmFyL2xvZy9hcGFjaGUyL2FjY2Vzcy5sb2cu Cj4KPgo+Cj4gRXZlbiB0aG91Z2ggd2UgaGF2ZSBzZWN1cmVkIHRoZSBVYnVudHUgTGludXggc2Vy dmVyIGJ5IGNoYW5naW5nIHBhc3N3b3JkcywgdGhlIGhhY2tlciB3YXMgc3RpbGwgYWJsZSB0byBk ZWxldGUgb3VyIGN1c3RvbWVyJ3MgTXlTUUwgZGF0YWJhc2UgYWdhaW4gYW5kIGFnYWluLiBJIGhh dmUgYWxyZWFkeSBwcm9wb3NlZCB0byBpbnN0YWxsIE1vZFNlY3VyaXR5IE9wZW4gU291cmNlIFdl YiBBcHBsaWNhdGlvbiBGaXJld2FsbCAoV0FGKSB0byBkZWZlbmQgYWdhaW5zdCB3ZWIgYXBwbGlj YXRpb24gYXR0YWNrcyBidXQgbXkgYm9zcyBoYXMgdG9sZCBtZSB0byBwdXQgdGhhdCBvbiBob2xk IGF0IHRoZSBtb21lbnQuIEluIGZhY3QsIEkgaGF2ZSBhbHJlYWR5IGRlcGxveWVkIE1vZFNlY3Vy aXR5IDIuOS4wIG9uIGEgVWJ1bnR1IDE2LjA0IExUUyAqVGVzdGluZyogc2VydmVyIGFuZCBmb3Vu ZCB0aGF0IGl0IGFjdGl2ZWx5IGRldGVjdHMgYW5kIGxvZ3MgTmVzc3VzIGFuZCBzcWxtYXAgdnVs bmVyYWJpbGl0eSBzY2FucyBpbiBibG9ja2luZyBtb2RlLgo+Cj4KPgo+IFNpbmNlIHdlIGRpZCBu b3QgZmluZCBhbnkgZXZpZGVuY2UgdGhhdCB0aGUgaGFja2VyIGhhZCBicmVhY2hlZCBvdXIgY3Vz dG9tZXIncyBVYnVudHUgMTYuMDQgTFRTIHByb2R1Y3Rpb24gc2VydmVyIHRocm91Z2ggc3NoIG9y IFRlYW12aWV3ZXIsIHdlIHN1c3BlY3QgdGhhdCB0aGUgaGFja2VyIGNvdWxkIGhhdmUgYWNoaWV2 ZWQgaXQgYnkgU1FMIGluamVjdGlvbi4gSSB0b29rIHRoZSBpbml0aWF0aXZlIG9mIGRvd25sb2Fk aW5nIGFuZCBpbnN0YWxsaW5nIE5lc3N1cyBQcm9mZXNzaW9uYWwgOC4zLjEgVHJpYWwgdmVyc2lv biBmb3IgV2luZG93cyA2NC1iaXQuIFRoZSB2dWxuZXJhYmlsaXR5IHNjYW4gcmVwb3J0IGdlbmVy YXRlZCBieSBOZXNzdXMgV2ViIEFwcGxpY2F0aW9uIFRlc3RzIHNob3dzIHRoYXQgb3VyIGN1c3Rv bWVyIGlzIHVzaW5nIGEgdmVyc2lvbiBvZiBwaHBNeUFkbWluIHByaW9yIHRvIDQuOC41IHdoaWNo IGNvdWxkIGJlIHZ1bG5lcmFibGUgdG8gU1FMIGluamVjdGlvbiB1c2luZyB0aGUgZGVzaWduZXIg ZmVhdHVyZS4KPgo+Cj4KPiBGdXJ0aGVyIHJlc2VhcmNoIHNob3dzIHRoYXQgSSBjYW4gdXNlIHNx bG1hcCB0byBkZXRlcm1pbmUgaWYgcGhwTXlBZG1pbiBpcyBTUUwgaW5qZWN0YWJsZS4gSSBhbHJl YWR5IGhhdmUgYSBUZXN0aW5nIFVidW50dSAxNi4wNCBMVFMgTGludXggc2VydmVyIHdpdGggYSBU ZXN0aW5nIE15U1FMIGRhdGFiYXNlIGFuZCBhIFRlc3RpbmcgcGhwTXlBZG1pbiA0LjguNC4gSSBo YXZlIHB1cnBvc2VseSBpbnN0YWxsZWQgcGhwTXlBZG1pbiA0LjguNCBiZWNhdXNlIHRoaXMgdmVy c2lvbiB3YXMgcmVwb3J0ZWQgdG8gYmUgdnVsbmVyYWJsZSB0byBTUUwgaW5qZWN0aW9uIHVzaW5n IHRoZSBkZXNpZ25lciBmZWF0dXJlLCBhbmQgb3VyIGN1c3RvbWVyIGlzIHVzaW5nIGEgdnVsbmVy YWJsZSB2ZXJzaW9uLCBhY2NvcmRpbmcgdG8gQ1ZFLTIwMTktNjc5OCAoIGh0dHBzOi8vbnZkLm5p c3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDE5LTY3OTggKS4gVGhlbiBJIHByb2NlZWRlZCB0byBk b3dubG9hZCBhbmQgZXhlY3V0ZSBzcWxtYXAgb24gb3VyIFVidW50dSBMaW51eCBkZXNrdG9wIGFn YWluc3Qgb3VyIFRlc3Rpbmcgc2VydmVyLgo+Cj4KPgo+IE5vIG1hdHRlciBob3cgbWFueSBjb21t YW5kcyBJIHRyeSwgc3FsbWFwIGFsd2F5cyByZXBvcnQgdGhhdCBwaHBNeUFkbWluIDQuOC40IGlz ICpOT1QqIFNRTCBpbmplY3RhYmxlLiBQZXJoYXBzIEkgd2FzIHVzaW5nIHRoZSB3cm9uZyBzcWxt YXAgY29tbWFuZHMgYWxsIHRoZSB0aW1lPyBUaGUgZm9sbG93aW5nIGlzIG9uZSBvZiB0aGUgbWFu eSBzcWxtYXAgY29tbWFuZHMgSSBoYXZlIHVzZWQuCj4KPgo+Cj4gJCBweXRob24gc3FsbWFwLnB5 IC11ICJodHRwczovL3d3dy5FWEFNUExFLmNvbS9waHlteWFkbWluL2luZGV4LnBocD9pZD0xIiAt LWxldmVsPTEgLS1kYm1zPW15c3FsIC0tc3FsLXF1ZXJ5PSJkcm9wIGRhdGFiYXNlIgo+Cj4KPgo+ IFJlcGxhY2UgZGF0YWJhc2UgYnkgZGF0YWJhc2UgbmFtZS4KPgo+Cj4KPiBNYXkgSSBrbm93IHdo YXQgaXMgdGhlIGNvcnJlY3Qgc3FsbWFwIGNvbW1hbmQgdGhhdCBJIHNob3VsZCB1c2UgdG8gZGV0 ZXJtaW5lIHRoYXQgbXkgVGVzdGluZyBwaHBNeUFkbWluIDQuOC40IGlzIFNRTCBpbmplY3RhYmxl PyBJIHdvdWxkIGxpa2UgdG8ga25vdyBpZiBJIGNhbiBzdWNjZXNzZnVsbHkgZHJvcC9kZWxldGUg dGhlIFRlc3RpbmcgZGF0YWJhc2Ugb24gb3VyIFRlc3Rpbmcgc2VydmVyLiBJZiBJIGNhbiBzdWNj ZXNzZnVsbHkgZHJvcC9kZWxldGUgdGhlIFRlc3RpbmcgTXlTUUwgZGF0YWJhc2UgdXNpbmcgc3Fs bWFwLCBJIHdvdWxkIGJlIGFibGUgdG8gY29uY2x1ZGUgdGhhdCB0aGUgaGFja2VyIG11c3QgaGF2 ZSBjYXJyaWVkIG91dCBTUUwgaW5qZWN0aW9uIHRvIGRyb3AvZGVsZXRlIHRoZSBjdXN0b21lcidz IGRhdGFiYXNlLiBJIGhhdmUgYWxyZWFkeSB0dXJuZWQgb2ZmIHRoZSBUZXN0aW5nIE1vZFNlY3Vy aXR5IFdlYiBBcHBsaWNhdGlvbiBGaXJld2FsbCBvbiBvdXIgVGVzdGluZyBzZXJ2ZXIgdG8gYWxs b3cgc3FsbWFwIHRvIGdvIHRocm91Z2guCj4KPgo+Cj4gUGxlYXNlIHBvaW50IG1lIHRvIGFueSBn b29kIHR1dG9yaWFsIG9uIFNRTCBpbmplY3Rpb24gdXNpbmcgc3FsbWFwLiBNYXliZSBJIGRvIG5v dCB1bmRlcnN0YW5kIFNRTCBpbmplY3Rpb24gd2VsbCBlbm91Z2guIE91ciBjdXN0b21lciBpcyBh bHNvIHVzaW5nIGEgY3VzdG9taXNlZCBpbi1ob3VzZSBpbnZlbnRvcnkgbWFuYWdlbWVudCBzeXN0 ZW0gdGhhdCByZWxpZXMgb24gUEhQIGFwcGxpY2F0aW9uIGFuZCBNeVNRTCBkYXRhYmFzZS4KPgo+ Cj4KPiBXb3VsZCBvcGVuIHNvdXJjZSBTbm9ydCBJbnRydXNpb24gRGV0ZWN0aW9uIFN5c3RlbSAo SURTKSBhbmQgSW50cnVzaW9uIFByZXZlbnRpb24gU3lzdGVtIChJUFMpIGJlIGFibGUgdG8gZGV0 ZWN0IGFuZCBibG9jayBTUUwgaW5qZWN0aW9uIGFzIHdlbGw/Cj4KPgo+Cj4gUGxlYXNlIGFkdmlz ZS4KPgo+Cj4KPiBUaGFuayB5b3UgdmVyeSBtdWNoLgo+Cj4KPgo+IC0tLS0tQkVHSU4gRU1BSUwg U0lHTkFUVVJFLS0tLS0KPgo+Cj4KPiBUaGUgR29zcGVsIGZvciBhbGwgVGFyZ2V0ZWQgSW5kaXZp ZHVhbHMgKFRJcyk6Cj4KPgo+Cj4gW1RoZSBOZXcgWW9yayBUaW1lc10gTWljcm93YXZlIFdlYXBv bnMgQXJlIFByaW1lIFN1c3BlY3QgaW4gSWxscyBvZgo+Cj4gVS5TLiBFbWJhc3N5IFdvcmtlcnMK Pgo+Cj4KPiBMaW5rOiBodHRwczovL3d3dy5ueXRpbWVzLmNvbS8yMDE4LzA5LzAxL3NjaWVuY2Uv c29uaWMtYXR0YWNrLWN1YmEtbWljcm93YXZlLmh0bWwKPgo+Cj4KPiAqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqKgo+Cj4KPgo+IFNpbmdhcG9yZWFuIE1yLiBUdXJyaXRvcHNpcyBE b2hybmlpIFRlbyBFbiBNaW5nJ3MgQWNhZGVtaWMKPgo+IFF1YWxpZmljYXRpb25zIGFzIGF0IDE0 IEZlYiAyMDE5Cj4KPgo+Cj4gWzFdIGh0dHBzOi8vdGR0ZW1jZXJ0cy53b3JkcHJlc3MuY29tLwo+ Cj4KPgo+IFsyXSBodHRwczovL3RkdGVtY2VydHMuYmxvZ3Nwb3Quc2cvCj4KPgo+Cj4gWzNdIGh0 dHBzOi8vd3d3LnNjcmliZC5jb20vdXNlci8yNzAxMjUwNDkvVGVvLUVuLU1pbmcKPgo+Cj4KPiAt LS0tLUVORCBFTUFJTCBTSUdOQVRVUkUtLS0tLQo+Cj4KPgo+IF9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCj4gRGV2ZWxvcGVycyBtYWlsaW5nIGxpc3QKPiBE ZXZlbG9wZXJzQHBocG15YWRtaW4ubmV0Cj4gaHR0cHM6Ly9saXN0cy5waHBteWFkbWluLm5ldC9t YWlsbWFuL2xpc3RpbmZvL2RldmVsb3BlcnMKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fCkRldmVsb3BlcnMgbWFpbGluZyBsaXN0CkRldmVsb3BlcnNAcGhw bXlhZG1pbi5uZXQKaHR0cHM6Ly9saXN0cy5waHBteWFkbWluLm5ldC9tYWlsbWFuL2xpc3RpbmZv L2RldmVsb3BlcnMK