There is a default my.cnf that comes with mysql (4+5) that will make mysql run a bit quicker if you have 2+ gig of ram cp -f /usr/share/mysql/my-large.cnf /etc/my.cnfThere is also my-huge.cnf, or my-medium.cnf depending on your hardware setup. Check the contents of these my*.cnf files for the one that’s right for you.
*NOTE* the log-bin option is enabled by default. This will quickly use a lot of disk space. It’s recommended to comment out the log-bin line from your /etc/my.cnf, if it exists.
Remember to restart mysql when you are done with your my.cnf tweaking:
Redhat:/sbin/service mysqld restart
** A patch was released. See http://blog.whmcs.com/?t=80223
WHMCS, a popular billing/support/customer management system, is still suffering from critical SQL injection issues. Today, yet another vulnerability, including exploit was released.
Due to the fact that there is no patch available at this point, I will refrain from linking to any exploit details, but it is pretty trivial to find the respective blog post which includes a script to exploit the vulnerability. WHMCS acknowledged the problem.
The root cause of this problem, as well as prior problems with the software, appears to be a lack in understanding of proper controls to prevent SQL injection. Good input validation is just a start, but prepared statements are a must. Instead, the WHMCS developers used a rather complex (and buggy) function to escape user input and assemble dynamic SQL queries.
The bug is in a function used throughout WHMCS, so the exploit is not limited to a particular URL.
# Exploit Title: WordPress - wp-realty - MySQL Time Based Injection
# Google Dork: inurl:"/wp-content/plugins/wp-realty/"
# Vendor: http://wprealty.org/
# Date: 10/08/2013
# Exploit Author: Napsterakos
exploits an unauthenticated
injection vulnerability affecting Zabbix
injection issue can be abused
order to retrieve an
. If an administrator level user is identified, remote code execution
can be gained by uploading
executing remote scripts via the