pianoliner.blogg.se

1. #SQLITEMANAGER FOR MAC HOW TO#
2. #SQLITEMANAGER FOR MAC FOR MAC OS#
3. #SQLITEMANAGER FOR MAC MAC OS#
4. #SQLITEMANAGER FOR MAC CODE#

SQLiteManager allows you to work with a wide range of SQLite 3 databases (like plain databases, in-memory databases, AES 128/256/RC4 encrypted databases, and also with cubeSQL server databases). It combines an easy-to-use interface with blazing speed and advanced features. There is currently a proposal to refuse such requests by default, and to create a new CORS headers to explicitly allow it.SQLiteManager is a powerful database-management system for SQLite databases. MAMP already has an alternative manager for SQLite available: phpLiteAdmin.Ī broader solution is to disallow requests from the public Internet to private RFC1918 IP addresses. Unless someone takes over the maintenance for SQLiteManager, it is unlikely that the vulnerabilities get fixed. MAMP users can do this themselves by editing /Applications/MAMP/conf/apache/nf.

#SQLITEMANAGER FOR MAC CODE#

When we trigger a request to the file, the execution of the osascript command shows the popup:īy combining CSRF and directory traversal we can trigger remote code execution, if the victim just visits a web site with malicious Javascript.Īn immediate solution to this would be to disable SQLiteManager.

Although we don’t know this, we can just try all numbers between 0 and 50 and hope that we hit the correct one. The dbsel number is the number corresponding to the database we just created. This makes it possible to run code on a victim that has MAMP installed and enabled when the victim visits a malicious site.įor example, the following Javascript issues a request that creates a database:įormData.append("valField", payload) įormData.append("action", "saveElement") įormData.append("after_save", "properties") We can issue POST requests using Javascript to create the database and add data to it, and then issue a request to the resulting file. SQLiteManager does not have any CSRF protection, so the directory traversal mentioned above can also be executed using CSRF. This method of bouncing requests through the victims browser is called cross site request forgery, or CSRF. These requests can access the SQLiteManager running on localhost. If you visit the attacker’s web site he can perform the requests from within the browser, on the same computer that MAMP is installed on. However, the attacker can “forge” requests if he can run Javascript in the browser. The SQLiteManager running on localhost cannot be accessed directly by an attacker. The file script.php will be a valid SQLite database file, containing PHP code that is run when the file is accessed. Then, using SQLiteManager, we create a table and add a row containing our PHP code. /htdocs/script.php, we can place a file script.php in the web root. We can also use this to get a file containing PHP code in the web root. to the filename we can place the database one directory higher.

This file is then created in the directory /Applications/MAMP/db/sqlite. An SQLite database is contained in a single file, and when creating the database it is possible to supply the filename for the new database.

It has not been updated since 2013 and contains some known vulnerabilities. It can create new databases, add tables to databases and run SQL queries on them.

SQLiteManager is a tool like phpMyAdmin for SQLite databases. Also included are some database management programs, such as phpMyAdmin and SQLiteManager. It installs the Apache web server, which runs on port 8888 by default. It is typically used by web developers to test the web applications they are working on.

#SQLITEMANAGER FOR MAC MAC OS#

MAMP is a web stack that can be installed on Mac OS X.

#SQLITEMANAGER FOR MAC HOW TO#

This post describes how to exploit these vulnerabilities to execute code when a user of MAMP visits a malicious web site. It comes with SQLiteManager, which has several vulnerabilities.

#SQLITEMANAGER FOR MAC FOR MAC OS#

MAMP is an Apache, MySQL, and PHP stack for Mac OS X.