digininja/DVWA

Access denied for created user to access DVWA in MariaDB after clicking on CREATE / RESET database in setup.php main page

ShadowNinja89 opened this issue · 3 comments

ShadowNinja89 commented

Before you raise a bug, please make sure you have fully read the README, especially if your bug relates to configuring the database.

Issues will be closed if the answer is in the README and no obvious attempts have been made to follow it.

Support will only be given for users running the latest pull of code from GitHub. Not a tagged release, not a pre-installed app, not a ZIP you got from a mate.

Describe the bug

I am receiving a PHP error saying access is denied for the Db_user account ID I set up in config.inc.php. of 'kali'@'localhost'. The error from my Apache2 error log specifically points to line 13 of mysql.php within the include/DBMS folder. This is despite me executing GRANT ALL PRIVILEGES statement to my db_user user ID I created on the DVWA database I created in MariaDB instance. See screenshots below from config.inc.php and Show grants; statement output in MariaDB.

To Reproduce

Being logged in my Kali Linux VM with default 'kali' user account, I go to http://localhost/DVWA/setup.php and am able to see the default setup php page. I click on the button CREATE / RESET database on this page and fatal access denied error occurs as described above.

Steps to reproduce the behaviour:

  1. Go to 'http://localhost/DVWA/setup.php'
  2. Click on button at bottom to create / reset database
  3. See fatal access error as described above. (reference screenshots for exact wording)

Logs

Please see screenshot provided.

Expected behavior

I expect the database to be created by MariaDB / MySQL backend DB instance and the login screen to be shown in browser.

What have you done to help fix the issue yourself?

I have executed GRANT ALL PRIVILEGES statement on my db_user user ID to all . as well as separately executed this statement on the DVWA database I created with the CREATE DATABASE command in MariaDB. A review of show grants output when logged in as root for my db_user user ID showed successful statement execution. Finally I rebooted the mysql service via statement service mysql restart.

Screenshots

See below.

System (please complete the following information):

  • OS: Kali Linux
  • Database and Version Maria DB , version 10.7
  • PHP Version: 8.2.0
  • Installed PHP modules - All required modules mentioned in Readme.txt and checked with apt command.

Additional MariaDB user information
Apache2 access error message
config inc php settings
Show grants mariadb output for kali user

digininja commented
ShadowNinja89 commented

Issue resolved. DVWA currently does not support the Unix socket method of authentication nor the ed25519 password hashing algorithm. When I dropped the user and recreated it using native SQL password authentication, I was able to access fine

digininja commented

You've mixed up a couple of things here. If you are connecting via the socket then you don't use a password, Mariadb uses the user the process is running as to authenticate against the system rather than using database authentication. In most instances the php script will be running as www-data and so you would need to have that as your database user, not kali. You also need to specify localhost as the server name, not 127.0.0.1 or anything like that. PHP treats localhost as meaning "connect by socket".

I created a www-data user in mariadb and set its auth to socket:

create user 'www-data'@localhost identified via unix_socket;
grant all privileges on dvwa.* to 'www-data'@localhost identified via unix_socket;
flush privileges;

Then set this in the config file:

$_DVWA = array();
$_DVWA[ 'db_server' ]   = 'localhost';
$_DVWA[ 'db_database' ] = 'dvwa';
$_DVWA[ 'db_user' ]     = 'www-data';
$_DVWA[ 'db_password' ] = ''; # not needed
$_DVWA[ 'db_port'] = '1'; # not needed but must be an integer

Browsing the SQLi issue, you can then see this in the database log to show it is connecting by a socket, not by TCP.

240222  8:40:33    299 Connect  www-data@localhost on  using Socket
                   299 Query    USE dvwa
                   300 Connect  www-data@localhost on dvwa using Socket
                   300 Prepare  SELECT first_name, last_name FROM users WHERE user_id = (?) LIMIT 1
                   300 Execute  SELECT first_name, last_name FROM users WHERE user_id = (1) LIMIT 1
                   299 Quit
                   300 Close stmt
                   300 Quit

You are right that PHP doesn't currently support passwords stored as ed25519, but that is a limitation of PHP, not DVWA.