Thread: Servage - Awful Security

Here is a support ticket I just submitted on my Servage account:

Originally Posted by 2008-10-21 22:19
Customer

Subject: Major Security Issue

Hi,

I just went to open phpmyadmin to look at some data in one of my mysql databases and I was presented with this:

http://img.photobucket.com/albums/v4...phpmyadmin.jpg
http://img.photobucket.com/albums/v4...hpmyadmin2.jpg

As you can see, this gives me full access to other customers' databases.

I am also unable to access my own databases.

Please can you explain why there is a massive security flaw here? I seriously hope that my data is more secure than these other poor sods.

Originally Posted by 2008-10-22 00:30
Support - Mark

Hello Andrew,

Thank you for submitting ticket.

Please provide us the exact database name for which you are facing problem. In order to further investigate and assist you in a better way.

Kind Regards
Mark, Support
Servage Hosting

*Sigh*.

Originally Posted by Schumie

LOL... out of interest, can you actually see the data in the DB's, or just the database names in the drop down list?

IIRC with phpMyAdmin, this is one of the configurable things to show all databases or not off the top of my head (or it used to be ~5 years ago... a lot has changed since then I know!)

Yes I can see all the data, and change it if I wanted to (See the second screenshot).

This has happened once before - for some reason the authentication allows me to see other people's databases (which of course I shouldn't be able to do).

It's quite annoying really as I can't see my databases (And I wonder who can!)

Originally Posted by freethought

at least you need to authenticate to get PHPMyAdmin - I just tried the URL to be cheeky but it wouldn't let me in without logging in
Now THAT would be one hell of a security flaw!

Haha, yes that would be even more amazing.

Indeed they haven't actually read the guys ticket, there do seem to be a fair few issues with servage on this sort of thing, I am sure I read some threads about it on wht.

Originally Posted by JamesSykes

"At this exact moment we host 179994 websites."

I also noticed that but I found it more interesting to read all about "ServageOS"

Originally Posted by 2008-10-23 12:09
Customer

Did you even read my ticket?

Did you see the subject which read - MAJOR SECURITY ISSUE?

You are an extremely disappointing host. I cannot believe how bad you have become.

Originally Posted by 2008-10-23 12:14
Support - John

Hello Andrew,

I have checked access to the databases' phpMyAdmin from your control panel by could not replicate the issue as shown in the jpg file.

Suggest you clear your browser's cache and check again.

Thanks.

Kind Regards
John, Support
Servage Hosting

The problem appears to be fixed now, but it will happen again as they didn't actually resolve anything - it resolved itself.

They just don't seem to understand how serious it was. Imagine if it was an e-commerce site database or something.

Ignore that. I get another database server with full access to someone else's database now.