DB Vulnerability

[Muffins 1]

hello guys,

i once saw a topic talking about a vulnerability in the database,

so to explain this, someone can connect to your db cache server, and also to any account without knowing the password.
(attacker must know id from account->account->id)

the fix was to block any connection coming to your db port except for localhost.

someone also mentioned that adding this: BIND_IP: 127.0.0.1 to your db config will fix this problem.

i tried to look for the BIND_IP in my db config but i didn't find it, i think it's an older thing or something that is not required now idk.
but my question is, how to actually block any connection coming to the db port to prevent this from happening ?

[WeedHex 661]

13 minutes ago, Muffins said:

hello guys,

i once saw a topic talking about a vulnerability in the database,

so to explain this, someone can connect to your db cache server, and also to any account without knowing the password.
(attacker must know id from account->account->id)

the fix was to block any connection coming to your db port except for localhost.

someone also mentioned that adding this: BIND_IP: 127.0.0.1 to your db config will fix this problem.

i tried to look for the BIND_IP in my db config but i didn't find it, i think it's an older thing or something that is not required now idk.
but my question is, how to actually block any connection coming to the db port to prevent this from happening ?

Database port should be closed if you use localhost

[Muffins 1]

2 minutes ago, WeedHex said:

Database port should be closed if you use localhost

i'm not really an expert on these type of stuff, but my server currently running on VPS.
how can i check for that ?

[WeedHex 661]

2 minutes ago, Muffins said:

i'm not really an expert on these type of stuff, but my server currently running on VPS.
how can i check for that ?

For checking ports use kinda https://www.yougetsignal.com/tools/open-ports/

To close the ports use your firewall, ask some AI to help you with rules.

[Muffins 1]

thanks for your help,
i asked an AI about this and it showed me that there can be 2 ways for this.
one is by using Packets Firewall, and second is by adding this to my.cnf: bind-address 127.0.0.1 which i did,
but that will only accept connection from the localhost so i can login to the game normally but i can't use Navicat anymore.

so that means i'll have to go for the firewall instead to add a bypass for my ip address to allow me to connect to the database.

is that right ?

Edited May 23, 2025 by Muffins

[Muffins 1]

23 hours ago, WeedHex said:

For checking ports use kinda https://www.yougetsignal.com/tools/open-ports/

To close the ports use your firewall, ask some AI to help you with rules.

thanks for your help,
i asked an AI about this and it showed me that there can be 2 ways for this.
one is by using Packets Firewall, and second is by adding this to my.cnf: bind-address 127.0.0.1 which i did,
but that will only accept connection from the localhost so i can login to the game normally but i can't use Navicat anymore.

so that means i'll have to go for the firewall instead to add a bypass for my ip address to allow me to connect to the database.

is that right ?

[Distraught 9951]

Yeah, because you told the MySQL server to only listen on localhost.

You need to just close the port used by the "db" program. Alternatively you can add BIND_IP = localhost or 127.0.0.1 to the conf.txt for your "db" program.

[Muffins 1]

20 hours ago, Distraught said:

Yeah, because you told the MySQL server to only listen on localhost.

You need to just close the port used by the "db" program. Alternatively you can add BIND_IP = localhost or 127.0.0.1 to the conf.txt for your "db" program.

is there a way to close the port and to allow it for navicat on my device only except for the firewall, or i just going to have to go for the firewall anyways,
because i did added 'BIND_IP = 127.0.0.1' and that didn't really do anything, but it was closed when i added it here: my.cnf