Re: Can arbitrary code run in a server if someone's know just the MySQL password?

Date	2013-10-02 11:15 -0400
From	Ned Batchelder <ned@nedbatchelder.com>
Subject	Re: Can arbitrary code run in a server if someone's know just the MySQL password?
References	<l2h31g$q96$1@dont-email.me> <524c1ee6$0$29984$c3e8da3$5496439d@news.astraweb.com> <l2h7qj$gqt$2@dont-email.me> <mailman.629.1380722323.18130.python-list@python.org> <l2hbjf$8mv$1@dont-email.me>
Newsgroups	comp.lang.python
Message-ID	<mailman.636.1380726953.18130.python-list@python.org> (permalink)

Show all headers | View raw

On 10/2/13 10:46 AM, Νίκος wrote:
> Στις 2/10/2013 4:58 μμ, ο/η Ned Batchelder έγραψε:
>> On 10/2/13 9:41 AM, Νίκος wrote:
>>> Στις 2/10/2013 4:25 μμ, ο/η Steven D'Aprano έγραψε:
>>>> On Wed, 02 Oct 2013 15:20:00 +0300, Νίκος wrote:
>>>>
>>>>> Is it possible for someone that knows the MYSQL password of a 
>>>>> server to
>>>>> run arbitrary code on a linux server?
>>>>
>>>> Yes, it is possible.
>>>
>>> Is that what might have happened and someone managed to upload the
>>> .html file in '~/home/nikos/www/' ?
>>>
>>> Can you think of any other way?
>>>
>>
>> As others have said in this thread, this is not a Python topic. Find
>> another forum for this question.  Do not ask it here again.
>>
>> You've said that you can improve.  Show us by not asking non-Python
>> questions here.
>>
>> --Ned.
> But i need to know what happened and how this .html file got uploaded.
> This is not a python question, but this happened from this pythons NG.
> And perhaps my python code was being utilized fo this upload to happen.
>
> I must know.
>

This is not a topic for Python-List.  We don't have answers for you, and 
you won't get answers to this question here.  If you persist in asking 
about it here, don't be surprised when people get angry with you.  This 
is anti-social behavior.

I know you are upset about your server being compromised.  I'm sorry 
about that, but it isn't on-topic here.  There are other places you can 
get help with your question.

--Ned.

Thread

Can arbitrary code run in a server if someone's know just the MySQL password? Νίκος <nikos.gr33k@gmail.com> - 2013-10-02 15:20 +0300
  Re: Can arbitrary code run in a server if someone's know just the MySQL password? Antoon Pardon <antoon.pardon@rece.vub.ac.be> - 2013-10-02 14:37 +0200
  Re: Can arbitrary code run in a server if someone's know just the MySQL password? feedthetroll@gmx.de - 2013-10-02 05:38 -0700
    Re: Killing threads with TB (was: Can arbitrary code run in a server if someone's know just the MySQL password?) Tim Chase <python.list@tim.thechases.com> - 2013-10-02 08:21 -0500
    Re: Killing threads with TB Terry Reedy <tjreedy@udel.edu> - 2013-10-02 18:34 -0400
    Re: Killing threads with TB Mark Lawrence <breamoreboy@yahoo.co.uk> - 2013-10-02 23:48 +0100
  Re: Can arbitrary code run in a server if someone's know just the MySQL password? Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2013-10-02 13:25 +0000
    Re: Can arbitrary code run in a server if someone's know just the MySQL password? Νίκος <nikos.gr33k@gmail.com> - 2013-10-02 16:41 +0300
      Re: Can arbitrary code run in a server if someone's know just the MySQL password? Ned Batchelder <ned@nedbatchelder.com> - 2013-10-02 09:58 -0400
        Re: Can arbitrary code run in a server if someone's know just the MySQL password? Νίκος <nikos.gr33k@gmail.com> - 2013-10-02 17:46 +0300
          Re: Can arbitrary code run in a server if someone's know just the MySQL password? ishish <ishish@domhain.de> - 2013-10-02 15:55 +0100
          Re: Can arbitrary code run in a server if someone's know just the MySQL password? Ned Batchelder <ned@nedbatchelder.com> - 2013-10-02 11:15 -0400
          Re: Can arbitrary code run in a server if someone's know just the MySQL password? Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-02 16:02 +0000
          Re: Can arbitrary code run in a server if someone's know just the MySQL password? Ethan Furman <ethan@stoneleaf.us> - 2013-10-02 09:59 -0700
      Re: Can arbitrary code run in a server if someone's know just the MySQL password? Alister <alister.ware@ntlworld.com> - 2013-10-02 14:34 +0000
        Re: Can arbitrary code run in a server if someone's know just the MySQL password? Ravi Sahni <ganeshsahni07@gmail.com> - 2013-10-02 20:43 +0530
          Re: Can arbitrary code run in a server if someone's know just the MySQL password? Νίκος Ακεξόπουλος <nikos.gr33k@gmail.com> - 2013-10-02 20:06 +0300
      Re: Can arbitrary code run in a server if someone's know just the MySQL password? Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2013-10-02 17:39 +0000
        Re: Can arbitrary code run in a server if someone's know just the MySQL password? Νίκος Αλεξόπουλος <nikos.gr33k@gmail.com> - 2013-10-02 21:02 +0300
  Re: Can arbitrary code run in a server if someone's know just the MySQL password? Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2013-10-02 20:02 -0400
  Re: Can arbitrary code run in a server if someone's know just the MySQL password? Tony the Tiger <tony@tiger.invalid> - 2013-10-04 15:19 -0500

csiph-web