Hi,
i recently found an sql injection vulnerability on a server,
In the db, there's a table named users and inside there's the username: admin and password : *******
Is knowing this password enough to hack the server ?
Thanks
Karlwakim 17 Junior Poster in Training
smantscheff 265 Veteran Poster
Wether you can connect to the mysql server depends on the combination of username, password and host entry in the mysql.user table. This table is not in your production database, but in a system database named mysql. If username and password match and the server from which the intruder operates matches the pattern in the mysql.user.host column, then the intruder can establish a connection. If this is sufficient to do any harm depends on the access rights which are granted to this user in the mysql access control tables.
For a quick test try to connect to your server from the outside using this admin password and see if you can access the database named mysql.
Karlwakim 17 Junior Poster in Training
Thanks,
The users table only 1 row.
There is 2 Db, information_shema and another one
smantscheff 265 Veteran Poster
Show the row from the user table.
Be a part of the DaniWeb community
We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.