phpMyAdmin security

vbmurray

I have just set up mySQL / PHP / Apache on my Windows 2000 Server. Everything is working great (finally)....except one part of mySQL.

I installed phpMyAdmin and I can get access to mySQL by entering a username like: ' ', ?, &, * etc...

I fixed the root password, and I have an admin username and password setup for myself....but all you have to do is just put in a space or any character and it will let you have access to mySQL....

Please help?

Has anyone run into that problem??

Van

trooper

sounds like you have some users in the mysql table that don't have a password.

From what i remember you need to remove all users that have either no password or have host of being %

HTH

vbmurray

I created passwords for those unprotected accounts and it still does not work. I also removed the accts. That doesnt work either.

Is there a generic account or a way to protect anonymous or when a username is entered that is not created?

the_Igel

Easy to check.
Run mysql.exe.
If you can get access to db without providing a username, then that's your fault, not myphpadmin's.

I can't believe that phpmyadmin is that insecure. :-/

jerdo

After you added the users did you reload MySql? It's a link from the main page of phpMyAdmin and if you don't do this after adding/removing a user or changing a password then MySql doesn't ever see the change.

vbmurray

I know it is easy to check, but how do you fix it? I need to figure out how to provide access only to maybe root and myself. How do you prevent spaces from being allowed access.

I restarted mysql