4 ms·
True. But the MySQL servers have layers of access control beyond passwords. The unauthorized access has been closed. So even if the attacker saved the passwords
by skeltoac 16y ago
True. But the MySQL servers have layers of access control beyond passwords. The unauthorized access has been closed. So even if the attacker saved the passwords, they don't have the other factors for a MySQL connection.
- jacques_chester 16y agoIf they have root access on the PHP servers they still access all the data in MySQL by writing code like this: <?php $pwnd = mysql_select_or_whatever_it_is('select * from sensitive_tables'); ?> Like most LAMP applications Wordpress uses only one connection with total access to all tables. It's the same unavoidable design issue that causes plugins and themes to be a security issue.