I have a company that has been attacked through SQL and their tables were removed. The attacker put a message replace it with all database entries.
The first thing that I did was to figure out if the sql port is open globally. What I saw was the sql 3306 open locally on 127.0.0.1. How the attacker reach it?
Hint: he didn't get any access to the server. The server is pretty secure outside.
They are running phpMyAdmin on the website and the website is running globally on port 80. What I know is that the sql is running locally. How could it be accessed?
No sql injection too, I guess.