modsecurity and phpmyadmin

[cDGo]

Is there a way to prevent modsecurity from breaking my phpmyadmin usage?
I've got a few rules to prevent some queries from being blocked, but I'm not getting closer to run a new specific query.
I would like to fully ignore modsecurity from intercepting the usage of phpmyadmin for my (fixed) IP address.

 

[Ohm J]

SecRule REQUEST_URI "@beginsWith /phpMyAdmin/" \
    "id:100001, \
    phase:1, \
    pass, \
    nolog, \
    chain"
    SecRule REMOTE_ADDR "@ipMatch 192.168.1.50" \
        "ctl:ruleEngine=Off"

please ensure "id" not same with other rules,

nginx can validate config rules via : nginx -t

 

[cDGo]

Hi Ohm,

Thank you for your responce.
That didn't work either, so I ended up blocking 2 id's globaly in DA's Default configuration.
And remove these after I finished testing.
Unfortunatly, you cannot add an IP to this.
So I need to do this each time

 

[LawsHosting]

Why they cannot bypass the phpmyadmin directory by default is beyond me.

 

[Ohm J]

I'm using comodo WAF,
normally I bypass without REMOTE_ADDR check for everyone

I just extended the rules for you,

 

[cDGo]

That works ok, and how I now using it to test.
But I do not want to open things up, for the world.

The problems are the concat, As and ifnull commands in the query
And involves the Id's 942151 (SQL Injection Attack: SQL function name detected), 930120 (OS File Access Attempt) and earlier I also had 932125 (Remote Command Execution: Windows Powershell Alias Command Injection)