full-disclosure - Re: MySQL trick for SQL injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 06 Nov 2009 13:03:34 -0600
From: Paul Schmehl <pschmehl_lists@...rr.com>
To: Tim <tim-security@...tinelchicken.org>, Valdis.Kletnieks@...edu
Cc: Full disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: MySQL trick for SQL injection

--On Friday, November 06, 2009 10:55:26 -0600 Tim 
<tim-security@...tinelchicken.org> wrote:

>
>> > INTO OUTFILE is a dangerous routine (as you've clearly demonstrated), but
>> > that privilege must be specifically granted to a user before it's possible
>> > to execute it.  No sensible administrator would grant the FILE privilege
>> > to a webserver application's database acccount.
>>
>> Very true, but a good blackhat always keeps a good supply of ways to exploit
>> common stupid administrator mistakes.  I'd not be surprised in the least if
>> more than 10% of the sites, some admin under time pressure to Just Fix It
>> assigned FILE privs to get the web application back up and running.
>
>
> I find it's more common that they just have the application log in as
> MySQL root.  It's foolish.  It happens more frequently than you'd like
> to admit.  Makes my app pentests easier though. ;-)
>

All true, but then we don't have a program flaw, we have a config flaw.  If you 
run your web applications with root privileges on the database, you should be 
surprised when your app gets exploited.

The question I have for the OP is whether or not he's found a true bug in mysql 
or simply exposed one of the millions of ways to exploit stupidity.

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/