phpmyadmin-misconfiguration: Sensitive data exposure

日期: 2025-08-01 | 影响软件: phpmyadmin | POC: 已公开

漏洞描述

Unauthenticated phpmyadmin leads to exposure of sensitive information

PoC代码[已公开]

id: phpmyadmin-misconfiguration

info:
  name: Sensitive data exposure
  author: pussycat0x
  severity: high
  description: |-
    Unauthenticated phpmyadmin leads to exposure of sensitive information
  reference:
    - https://www.exploit-db.com/ghdb/6997
  tags: phpmyadmin,misconfiguration
  created: 2023/10/13

rules:
  r0:
    request:
      method: GET
      path: /phpmyadmin/index.php?db=information_schema
    expression: |
      response.status == 200 && response.body.bcontains(b"var db    = 'information_schema';") && response.body.bcontains(b"var opendb_url = 'db_structure.php';")
  r1:
    request:
      method: GET
      path: /phpMyAdmin/index.php?db=information_schema
    expression: |
      response.status == 200 && response.body.bcontains(b"var db    = 'information_schema';") && response.body.bcontains(b"var opendb_url = 'db_structure.php';")
expression: r0() || r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/phpmyadmin-misconfiguration.yaml

相关漏洞推荐