bugtraq - Re: phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051219085018.15679.qmail@securityfocus.com>
Date: 19 Dec 2005 08:50:18 -0000
From: michal@...ar.com
To: bugtraq@...urityfocus.com
Subject: Re: phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.

Hi

There is no vulnerability in this - user needs to be logged in. You can do same (without messing SQL injection) by directly passing SQL statements to import.php or sql.php. Yes phpMyAdmin allows to execute queries to authenticated users, but it's main task of this program and can not be considered as vulnerability.

Michal