CVE-2017-1000499 PoC — phpMyAdmin 跨站请求伪造漏洞

Source

https://github.com/Villaquiranm/5MMISSI-CVE-2017-1000499

Associated Vulnerability

Title:phpMyAdmin 跨站请求伪造漏洞 (CVE-2017-1000499)
Description:phpMyAdmin是phpMyAdmin团队开发的一套免费的、基于Web的MySQL数据库管理工具。该工具能够创建和删除数据库，创建、删除、修改数据库表，执行SQL脚本命令等。 phpMyAdmin 4.7.6.1/4.7.7之前的4.7.x版本中存在跨站请求伪造漏洞。远程攻击者可通过诱使用户点击特制的URL利用该漏洞对数据库执行破坏操作，例如删除记录，删除/截断表单。

Readme

# 5MMISSI-CVE-2017-1000499

### PoC of [CVE-2017-1000499](https://www.cvedetails.com/cve/CVE-2017-1000499/?q=CVE-2017-1000499)
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc. 

### Contents
- Makefile
- web/index.html

### Instructions
#### Getting all prepared

```shell
git clone https://github.com/Villaquiranm/5MMISSI-CVE-2017-1000499.git
cd 5MMISSI-CVE-2017-1000499/
```
#### Building docker enviroment
To build both containers you only need to type a single command.
```shell
make create
```
At this point it is necessary to wait because php server and database need to be configurated. This delay is approximately one minute after a successful build.

#### Experimenting with your exploid
1. First go to [Localhost](http://localhost/).
2. Type root as user and password. (if you get an error it is because server is still configurating itself).
3. Observe carefully all your database schemas.

4. Assuming you are still in this repository. We will create a Python server to exploit this vulnerability.
```shell
cd web/
python -m SimpleHTTPServer 8888
```
5. Go to [Localhost:8888](http://localhost:8888/).
6. Reaload your database page (localhost).
#### Destroying docker enviroment
```shell
make clean
```

File Snapshot


 [4.0K]  /data/pocs/855a620f5fa5fc13fa905cafc4ee0a6462fc3798
├── [ 401]  Makefile
├── [1.4K]  README.md
└── [4.0K]  web
    └── [ 729]  index.html

1 directory, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!