CVE-2019-7731
📋 TL;DR
MyWebSQL 3.7 has a remote code execution vulnerability where attackers can write PHP shell code into a database, then trigger the Backup Database function with a .php filename extension. This allows execution of arbitrary code on the server. Anyone running MyWebSQL 3.7 without proper security controls is affected.
💻 Affected Systems
- MyWebSQL
📦 What is this software?
Mywebsql by Mywebsql
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, lateral movement, ransomware deployment, or complete system takeover.
Likely Case
Webshell installation allowing persistent access, data exfiltration, and further exploitation of the server environment.
If Mitigated
Limited impact with proper network segmentation, file upload restrictions, and web application firewalls blocking malicious requests.
🎯 Exploit Status
Exploit requires database write permissions. Attack chain involves writing PHP code to database then triggering backup with .php extension.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to MyWebSQL version after 3.7
Vendor Advisory: https://github.com/samnan/MyWebSQL
Restart Required: No
Instructions:
1. Download latest MyWebSQL version from official repository. 2. Replace existing installation files. 3. Verify backup functionality no longer accepts .php extensions.
🔧 Temporary Workarounds
Disable Backup Functionality
allRemove or restrict access to database backup feature
# Remove backup.php or restrict via .htaccess
File Extension Restriction
allConfigure web server to block .php file execution from backup directory
# Apache: <Files "*.php"> Deny from all </Files>
# Nginx: location ~ \.php$ { deny all; }
🧯 If You Can't Patch
- Network segmentation: Isolate MyWebSQL server from critical systems
- Implement WAF rules to block suspicious backup requests and file uploads
🔍 How to Verify
Check if Vulnerable:
Check if running MyWebSQL 3.7 and test if backup function accepts .php extensionsCheck Version:
Check MyWebSQL version in interface or read version.txt fileVerify Fix Applied:
Attempt to trigger backup with .php extension - should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual database write operations followed by backup requests
- Backup requests with .php file extensions
- PHP file creation in backup directories
Network Indicators:
- POST requests to backup.php with suspicious parameters
- Unexpected file uploads to backup locations
SIEM Query:
source="web.log" (backup.php AND ".php") OR ("PUT" AND "/backup/")