dbkiss

DBKiss 1.11 is a legitimate open-source PHP database administration tool — a single-file alternative to phpMyAdmin for quick database browsing and query execution. The clean version is a genuine utility used by developers and sysadmins. The version circulating in underground channels is not clean.

Capabilities

Single-file database admin panel. Database browsing, query execution, table management — the standard phpMyAdmin alternative for environments where a full phpMyAdmin install is impractical. Cookie-based authentication using a database password set by the operator. Runs on PHP 5.x through 8.x.

W0rm Supply-Chain Injection

The poisoned DBKiss carries the most discreet W0rm injection in the entire corpus. The backdoor is embedded inside a define() block that looks like normal application configuration. Unlike the obvious injections in WSO or r57 (where W0rm code is visibly prepended at the top of the file), the DBKiss injection blends into the existing codebase structure — appearing to be part of the tool’s own constant definitions.

The injection is not just stealthy — it is structurally pre-auth. The W0rm RCE payload accepts a GET parameter and executes at PHP parse/compilation time, inside the constant definition block. The legitimate DBKiss authentication (which requires a database password set via cookie) does not begin until much later in the file. The backdoor fires unconditionally on every HTTP request — including requests from users who have never authenticated, and including requests to paths that should not execute code at all.

The same W0rm infrastructure components are present: an xsec/blocker-style file upload backdoor for persistent secondary access, and a Pastebin C2 beacon that exfiltrates the server URL and installation path back to the operator.

The legitimate origin of the tool is what makes the poisoning effective. A developer downloading a known open-source utility has less reason to audit the source than someone downloading an explicitly underground webshell. The injection point — a define() block — is the last place a cursory code review would flag. This is the supply-chain pattern at its most effective: take a trusted tool, inject a minimal backdoor, redistribute through the same channels the original circulates in.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_dbkiss {
    meta:
        description = "dbkiss 1.11 database admin carrying the W0rm supply-chain injection (clean upstream dbkiss is NOT flagged)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/dbkiss/"
        status      = "validated"

    strings:
        $title      = "dbkiss" ascii nocase
        $w0rm_log   = "errors_log" ascii
        $w0rm_b64pb = "aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3" ascii
        $w0rm_cmd   = "$_GET[\"cmd\"]" ascii
        $w0rm_pb    = "pastebin.com/raw/" ascii

    condition:
        filesize < 200KB
        and $title
        and ($w0rm_log or $w0rm_b64pb or $w0rm_cmd or $w0rm_pb)
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

OHIIHO Threat Research.