LeakedIn Logo
Stories About Data Leaks and Related Stuff

Potential leak of data: MySQL Access Control

0 votedvote

Detected 2 occurrence(s) of ‘create user .* identified by’:

d one for local user. if we don't specify the local one,
		// the anonymous user would take precedence when there is one.
		$query = "CREATE USER '$name'@'localhost' IDENTIFIED BY '$password'";
		$result = mysql_query($query, $connection);
		$query = "CREATE USER '$name'@'%' IDENTIFIED BY '$password'";
		$result = mysql_query($query, $connection);
	}

	public static function pg_createDatabase($name,$user,$connection) {
		//we cant use OC_BD functions here because we need to connect as the administrative user.
		$e_name = pg_escape_st

Source: http://pastebin.com/raw.php?i=G3j9uHWD

Tags: ,

Comments are closed.