Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PhpMyAdmin Project Successfully Completes Security Audit

phpmyadmin.net

Post reply on HN
Print view View original

21–30 of 112 posts

Re: PhpMyAdmin Project Successfully Completes Security Audit

#21

Post by Rangi42 »

creshal wrote: post #7
sync wrote: post #3

> A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer. > Improper cookie invalidation that could allow an attacker to unset internal global variables. Those don't count as serious issues? Props to them for making the report public though.

> > A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer. Iff the user has Excel, and explicitly allows it to run macros in a CSV file. It's already a stretch to call this a phpMyAdmin vulnerability, much less a "medium severity" one. > > Improper cookie invalidation that could allow an attacker to unset internal global variables. From the PDF report…

> Because of the large amount of global variables... NCC Group was unable to fully determine the impact of this vulnerability.

In other words, "This project is too full of potential security holes to find the definite ones."

Re: PhpMyAdmin Project Successfully Completes Security Audit

#22

Post by Johnny_Brahms »

creshal wrote: post #6

And in the PDF, the auditors complain that they didn't have enough time to even fully analyze the impact of the vulnerabilities found. I wouldn't read too much into it.

That is misleading. They said they had the ability to unset global variables. Looking at the PHPMyAdmin codebase, I understand they didn't have the time.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#23

Post by markplindsay »

whatsamattayou wrote: post #14
pinum wrote: post #11

Earlier quoted context omitted.

I can't think of much reason to use it over Workbench or Sequel Pro.

Some dev environments aren't local, and sometimes this is faster, especially if you have to document the changes for future updates that don't include your fancy tools.

Sequel Pro's built-in SSH tunnel has worked for me in every remote development situation I've encountered.

It seems like a really bad idea to place a web-based database tool on a public-facing host when technology exists to route MySQL through SSH.

Even shared hosts support SSH these days. If yours doesn't, maybe it's time to find another shared host!

Re: PhpMyAdmin Project Successfully Completes Security Audit

#24

Post by drzaiusapelord »

Rangi42 wrote: post #21
creshal wrote: post #7

Earlier quoted context omitted.

> > A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer. Iff the user has Excel, and explicitly allows it to run macros in a CSV file. It's already a stretch to call this a phpMyAdmin vulnerability, much less a "medium severity" one. > > Improper cookie invalidation that could allow an attacker to unset internal global variables. From the PDF report…

> Because of the large amount of global variables... NCC Group was unable to fully determine the impact of this vulnerability. In other words, "This project is too full of potential security holes to find the definite ones."

No, it means we understand there are theoretical security issues with global variables, but cannot determine if they're actually applicable or exploitable in this software.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#25

Post by drzaiusapelord »

donjh wrote: post #4
smaili wrote: post #2

Does anyone still use this? I didn't realize this was still actively maintained.

Countless people maintaining WordPress sites do.

Every Drupal dev shop we've worked this insisted this was installed on the server. Its just firewalled off/tunneled/whatever for safety.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#26

Post by bowlich »

pinum wrote: post #11
creshal wrote: post #8

Earlier quoted context omitted.

If you are using MySQL, and need to manually fuck around with tables for whatever reason, it's really useful and beats most other options. For us it sees plenty of use with poorly developed legacy software (e.g. Wordpress).

I can't think of much reason to use it over Workbench or Sequel Pro.

Sequel Pro - No native linux support

Workbench - Massively unstable on linux. (Although I do like the visualizing tools assuming I'm willing to put up with it crashing every hour or so).

Re: PhpMyAdmin Project Successfully Completes Security Audit

#27

Post by toxican »

waterphone wrote: post #15
smaili wrote: post #2

Does anyone still use this? I didn't realize this was still actively maintained.

Anyone using shared hosting (e.g. most people who do web development for small businesses) does.

I think many (most?) web developers get their start on some shared hosting provider where your only obvious option for managing MySQL databases is phpmyadmin. You have to dig a little deeper to realize you cna use MySQL Workbench, but even then a lot of them disable remote MySQL and SSH so you're SOL.

So for me, at least, it's ingrained in my head that phpmyadmin is the best tool for the job given the limitations of what I've got. Although I recently switched my company's reseller hosting account to a provider that actually allows remote MySQL or SSH, so that's exciting.

Re: PhpMyAdmin Project Successfully Completes Security Audit

#28

Post by [deleted] »

creshal wrote: post #16
onion2k wrote: post #12

Earlier quoted context omitted.

If you need to make a manual database change then Adminer is often a better option[1]. It's doesn't have the featureset as PHPMyAdmin but it has a huge advantage in that it's a single PHP file you can upload, make the necessary changes, and then delete. If you're interested in maintaining a secure server but you don't have any better options than using a script, then it's better to upload something when you need it t…

> It's doesn't have the featureset as PHPMyAdmin but it has a huge advantage in that it's a single PHP file you can upload, make the necessary changes, and then delete The days of painfully slow FTP servers are long gone where "it's one file" would count as advantage. This leaves a massively worse UX and featureset. (We are using adminer for postgresql databases, because there's no better alternative, and it makes me…

[deleted]

Re: PhpMyAdmin Project Successfully Completes Security Audit

#29

Post by ivanceras »

creshal wrote: post #16
onion2k wrote: post #12

Earlier quoted context omitted.

If you need to make a manual database change then Adminer is often a better option[1]. It's doesn't have the featureset as PHPMyAdmin but it has a huge advantage in that it's a single PHP file you can upload, make the necessary changes, and then delete. If you're interested in maintaining a secure server but you don't have any better options than using a script, then it's better to upload something when you need it t…

> It's doesn't have the featureset as PHPMyAdmin but it has a huge advantage in that it's a single PHP file you can upload, make the necessary changes, and then delete The days of painfully slow FTP servers are long gone where "it's one file" would count as advantage. This leaves a massively worse UX and featureset. (We are using adminer for postgresql databases, because there's no better alternative, and it makes me…

Didn't postgresql community just annouced pgadmin4 lately and it seems to come with a modern webclient https://www.pgadmin.org/
Post reply on HN