{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/8129","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8129/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8129/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8129/events","html_url":"https://github.com/joomla/joomla-cms/issues/8129","id":112978162,"number":8129,"title":"Database error message exposes database prefix","user":{"login":"ryandemmer","id":152333,"avatar_url":"https://avatars.githubusercontent.com/u/152333?v=3","gravatar_id":"","url":"https://api.github.com/users/ryandemmer","html_url":"https://github.com/ryandemmer","followers_url":"https://api.github.com/users/ryandemmer/followers","following_url":"https://api.github.com/users/ryandemmer/following{/other_user}","gists_url":"https://api.github.com/users/ryandemmer/gists{/gist_id}","starred_url":"https://api.github.com/users/ryandemmer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryandemmer/subscriptions","organizations_url":"https://api.github.com/users/ryandemmer/orgs","repos_url":"https://api.github.com/users/ryandemmer/repos","events_url":"https://api.github.com/users/ryandemmer/events{/privacy}","received_events_url":"https://api.github.com/users/ryandemmer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-10-23T08:42:58Z","updated_at":"2015-10-23T10:22:02Z","closed_at":null,"body":"With reference to - https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access - it seems necessary to know the database prefix in order to execute this exploit successfully.\r\n\r\nGiven that the prefix is shown in a database error message, it is trivial to discover the prefix; one merely needs to execute an SQL injection attempt and receive the error message to recover the prefix.\r\n\r\nGranted, although one could argue that preventing SQL Injection in the first place makes masking the prefix redundant, the exploit above would not have been possible (or at the very least made more difficult) if it was not possible to easily retrieve or guess the database prefix. \r\n\r\nFurthermore, the point of creating a random prefix string in the Joomla setup process, presumably as an added level of security, is itself redundant if it can be retrieved easily.\r\n\r\nI propose that the prefix is removed from the error message, eg: \r\n\r\nhttps://github.com/joomla/joomla-cms/blob/staging/libraries/joomla/database/driver/mysqli.php#L585\r\n\r\n```php\r\n$this->errorMsg = (string) mysqli_error($this->connection) . ' SQL=' . str_replace($this->tablePrefix, '#__', $query);\r\n```\r\n\r\nOf course this would need to be done in all the other drivers too."},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/150536806","html_url":"https://github.com/joomla/joomla-cms/issues/8129#issuecomment-150536806","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8129","id":150536806,"user":{"login":"zero-24","id":2596554,"avatar_url":"https://avatars.githubusercontent.com/u/2596554?v=3","gravatar_id":"","url":"https://api.github.com/users/zero-24","html_url":"https://github.com/zero-24","followers_url":"https://api.github.com/users/zero-24/followers","following_url":"https://api.github.com/users/zero-24/following{/other_user}","gists_url":"https://api.github.com/users/zero-24/gists{/gist_id}","starred_url":"https://api.github.com/users/zero-24/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zero-24/subscriptions","organizations_url":"https://api.github.com/users/zero-24/orgs","repos_url":"https://api.github.com/users/zero-24/repos","events_url":"https://api.github.com/users/zero-24/events{/privacy}","received_events_url":"https://api.github.com/users/zero-24/received_events","type":"User","site_admin":false},"created_at":"2015-10-23T10:22:02Z","updated_at":"2015-10-23T10:22:02Z","body":"PR is: https://github.com/joomla/joomla-cms/pull/8130 Thanks @ryandemmer :+1: "}}