Re: SQL Injecting PhpMyAdmin
by flupkear on Wednesday June 04, 2008 @07:42PM
(#209490)
the solution is simple, give access to your database only to people you trust and don´t access to your super important database from a public location using phpMyAdmin!
[ Parent
| on HN ]
That's not a solution. You can read more about XSRF and how to protect against it: http://en.wikipedia.org/wiki/Cross-site_request_forgery
I have my phpMyAdmin installed only on my secure site, behind HTTP authentication as well.
If you're using HTTP Basic auth, your browser will happily cache the credentials and re-submit them every time when asked for the same server/realm combination. You'll need to restart your browser to clear the cached auth data.
The reason CSRF is scary is that it works against those defences.
Actually, the solution is not to ever use phpMyAdmin on a public web server. Just like Webmin, and every other tool that has god-like power over critical system resources, it should be on a private IP, accessible only from trusted systems via an encrypted, strongly-authenticated channel.
This doesn't help. If you use the same web browser for using phpMyAdmin that you use for visiting the attacker's site, you're hacked.
"Strongly-encrypted channel" basically means VPN in my book. If the phpMyAdmin server isn't on a publicly-routable IP, and you don't have the VPN tunnel open when you aren't using the secure host, then it will in fact defeat CSRF.