Description

phpmyfaq has a feature to restore from a backup the entire application. An attacker with admin grant can export the configuration and re-upload the same file bypassing all the backend sanitization and controls.

Proof of Concept XSS

1. • login as admin
2. • go to backup page
3. • Create a backup and download it
4. • Edit or add some query to file
5. • in this case i edited the content of a category in order to fire an XSS on the admin panel or homepage
6. • navigate some page and see the xss (homepage, list categories etc).

PoC-Payload:

#MISCONF

In case of misconfiguration of the SQL service user grant. An attacker could abuse of that by reading/write sensitive file.

Example (read file grant) 1:

• Read ssh keys, or passwd etc…

SELECT LOAD_FILE('/etc/passwd') 

Example (write file grant) 2:

• write a php shell file in the root of the server web (the path is discovered from the system information-> Server Document Root)

SELECT  'some php code '  INTO dumpfile '/sitepath/somefile.php'