-1

Currently I get the latest phpMyAdmin unzip and load into my www folder and just run it. Recently there was an attack via phpMyAdmin. So what is the correct method I should install to avoid this type of vulnerable attack ony my server in future? My os is centos and the attack was due to this PhpMyAdmin vulnerability CVE-2011-2505 (http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2505)

2
  • Needs more detail, what OS (distribution), what was the attack, how did it succeed, how have you configured phpMyAdmin once installed, etc. May 11, 2012 at 16:58
  • I have provided my os and also the cause of the vulnerability too. I just copy the whol phpMyAdmin into the www folder and I did not protect it further so what should I do now?
    – user111196
    May 11, 2012 at 18:01

2 Answers 2

3

Beside the points @rackandboneman mentioned, you should not deploy phpMyAdmin on a well known or common location (e.g. http://www.example.com/phpMyAdmin/) but ideally on a seperate vhost (e.g. https://admin.example.com/phpmyadmin/) where the whole root is protected by Apache Authentication (as an addition to the MySQL authentication done by phpMyAdmin).

Furthermore, you should restrict the login of your application users to only the required databases/tables.

3
  • Ideally you would not have phpmyadmin in the URL at all. Most scans I've seen on my servers scan for both properly capitalized default path and the all lower case version. A subdomain isn't really going to help you much unless its not listed anywhere a bot can scrape.
    – Kyle
    May 11, 2012 at 17:14
  • If the whole subdomain is protected by proper authentication (NOT the database authentication) no bot can crawl this domain. Even if it is known.
    – ercpe
    May 11, 2012 at 17:24
  • @Johann so how to protect with proper authentication then? Any help please? So what should be my first step now? How install phpMyAdmin the right way?
    – user111196
    May 11, 2012 at 17:58
1

Also here: set up http auth, probably via ssl, in addition to any login mechanism phpmyadmin provides. So a user that is not authenticated just CAN not mess with anything unless he can break the httpd itself.

1
  • How to set this http auth? Any tips on this. I first need to build a .htaccess folder on my www is it?If I need it to be https how to configure it?
    – user111196
    May 11, 2012 at 17:57

Not the answer you're looking for? Browse other questions tagged .