Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missed phpMyAdmin panel #10451

Closed
DShelef opened this issue Aug 1, 2024 · 3 comments · Fixed by #10579
Closed

Missed phpMyAdmin panel #10451

DShelef opened this issue Aug 1, 2024 · 3 comments · Fixed by #10579
Assignees
Labels
Done Ready to merge false-negative Nuclei template missing valid results

Comments

@DShelef
Copy link

DShelef commented Aug 1, 2024

Template file:

http/exposed-panels/phpmyadmin-panel.yaml

Command to reproduce:

Still validating if I can share the website on which the issue was detected.


Apparently there are websites which require the suffix index.php to reply with the panel itself.
For my specific example, browsing to https://website/phpMyAdmin/ returns 404, but browsing to https://website/phpMyAdmin/index.php returns the login page (the issue is not detected unless I add phpMyAdmin/index.php to the template).
I guess this is relevant to all the tested paths. Maybe it is worth to add for each path a copy which includes the index.php as well.

This is a problem I encountered with several other services in the past as well, but I do not remember which services right now 😅. If you find this issue relevant, please let me know and I will notify you on future cases.

@DShelef DShelef added the false-negative Nuclei template missing valid results label Aug 1, 2024
@princechaddha princechaddha linked a pull request Aug 21, 2024 that will close this issue
2 tasks
@princechaddha
Copy link
Member

Hi @DShelef, The response time to this issue was much longer than usual. Thank you for taking the time to create this issue and for contributing to this project. We have now added the additional path to the template.

@princechaddha princechaddha added the Done Ready to merge label Aug 21, 2024
@DShelef
Copy link
Author

DShelef commented Aug 26, 2024

@princechaddha
Thanks for your response and sorry for not including an example website. I can add it now, but it seems to not be relevant anymore.
I noticed you added index.php to only one of the 14 or so paths in the template. Don't you think the same issue might occur with other paths as well?
I'm not sure myself why the index.php is required by some websites, it's only my gut feeling here, so feel free to disagree.

@princechaddha
Copy link
Member

@DShelef, if you have an example of a website that uses index.php in different paths, we might consider creating a fuzzing template for it instead of adding numerous paths to the existing templates. Edge cases can always arise, and adding too many requests per template might not be the most efficient approach

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Done Ready to merge false-negative Nuclei template missing valid results
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants