phpMyAdmin preg_replace()远程PHP代码执行

Tests: 1. Log in to PMA and select database: http://localhost/PMA/index.php?db=test&token=25a6ce9e288070bd28c3f9aebffad1b8 2. select one table from database by using checkbox and then select "Replace table prefix" from select control "With selected:". 3. We can see form named "Replace table prefix:" with two input fields. Type "/e%00" to the "From" field and "phpinfo()" to the "To" field. 4. Activate Tamper Data Firefox add-on: https://addons.mozilla.org/en-us/firefox/addon/tamper-data/ 5. Click "Submit", Tamper Data pops up, choose "Tamper". 6. Now we can modify POST request. Look for parameter "from_prefix". It should be "%2Fe%2500", remove "25", so that it becomes "%2Fe%00". Click "OK" and Firefox will send out manipulated POST request. 7. We are greeted by phpinfo function output - code execution is confirmed.