Comments on: pmafind http://blog.arithm.com/2007/07/27/pmafind/ Software. Politics. Tinfoil hat conjecture. Mon, 30 Jan 2012 09:08:16 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: deadman http://blog.arithm.com/2007/07/27/pmafind/comment-page-1/#comment-139 deadman Thu, 10 Jan 2008 08:31:29 +0000 http://blog.arithm.com/2007/07/27/pmafind/#comment-139 This script is designed by someone to look into websites where phpmyadmin and mysql was not configured properly. Some projects out there like XAMPP,defaults after installing to settings that leave the server open for attacks. Specifically phpmyadmin. When XAMPP installs mysql, it creates a root account with no password. And sets up phpmyadmin to access the mysql server through the root user, which does not need a password. When such access is available, the attacker can easily get into mysql and through it create a file that will give the attacker full shell access. I've tried it myself and it works. This is not a vulnerability or weaknesses on software, but through the ignorant use of software by users out there who have no idea what they are working on. XAMPP is a great project. The exploit is not tied to that project. It was provided as an example. This script is designed by someone to look into websites where phpmyadmin and mysql was not configured properly.

Some projects out there like XAMPP,defaults after installing to settings that leave the server open for attacks. Specifically phpmyadmin.

When XAMPP installs mysql, it creates a root account with no password. And sets up phpmyadmin to access the mysql server through the root user, which does not need a password. When such access is available, the attacker can easily get into mysql and through it create a file that will give the attacker full shell access.

I’ve tried it myself and it works.

This is not a vulnerability or weaknesses on software, but through the ignorant use of software by users out there who have no idea what they are working on.

XAMPP is a great project. The exploit is not tied to that project. It was provided as an example.

]]>