MySQL-interface

MySQL-interface is a standalone web-based database administration tool — a single PHP file that provides a browser UI for running SQL queries, browsing tables, and managing database structures. In this corpus, the file has been poisoned by the W0rm redistributor: a pre-auth RCE backdoor (?cmd=) fires at global scope before any panel authentication, giving any visitor full command execution regardless of the panel’s own login gate.

Capabilities

MySQL-interface appears at a specific stage in the post-access workflow. Config grabbers (wp-config readers, Joomla configuration extractors, Laravel .env dumpers) harvest database credentials from application configuration files. The operator now has a hostname, username, and password — but no interface to use them. MySQL-interface provides that interface: upload one PHP file, edit the hardcoded connection parameters, and gain full interactive access to the database through a browser.

The tool is deployed alongside webshells but serves a different purpose. A webshell provides system-level command execution; MySQL-interface provides structured database access — table browsing, query execution, data export. Operators use it when they need to dump user tables, extract stored credentials, modify application data, or insert backdoor admin accounts into CMS databases.

Vulnerabilities

The distinctive finding is the configuration model itself. Database credentials are hardcoded directly in the PHP source — host, username, password in plaintext. The operator edits the file, uploads it, and connects. This means anyone with read access to the PHP file (another webshell on the same host, a directory listing misconfiguration, a backup archive) immediately obtains the database credentials. The tool’s own design creates a secondary credential exposure — the credentials it uses are only as secure as the web-accessible directory it sits in.

The W0rm backdoor is the dominant finding. The panel’s own authentication is moot — the backdoor executes before the login check and provides full command execution to any HTTP request carrying the cmd parameter. The hardcoded credentials and variable injection are additional attack surface, but secondary to the supply-chain compromise.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_mysql_interface {
    meta:
        description = "MySQL-interface web admin with W0rm supply-chain backdoor (tryag_vb variant)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/mysql-interface/"
        status      = "validated"

    strings:
        $extract    = "extract($HTTP_POST_VARS)" ascii
        $cred_user  = "tryag_vb" ascii
        $cred_pass  = "102030" ascii
        $mysql_q    = "mysql_query" ascii
        $mysql_conn = "mysql_connect" ascii

    condition:
        filesize < 60KB
        and ($extract or ($cred_user and $cred_pass))
        and ($mysql_q or $mysql_conn)
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

OHIIHO Threat Research.