Full Disclosure: Re: MySQL trick for SQL injection

[Paul Schmehl <pschmehl_lists () tx rr com>]

--On Friday, November 06, 2009 10:55:26 -0600 Tim 
<tim-security () sentinelchicken org> wrote:

> > > INTO OUTFILE is a dangerous routine (as you've clearly demonstrated), but
> > > that privilege must be specifically granted to a user before it's possible
> > > to execute it.  No sensible administrator would grant the FILE privilege
> > > to a webserver application's database acccount.
> > Very true, but a good blackhat always keeps a good supply of ways to exploit
> > common stupid administrator mistakes.  I'd not be surprised in the least if
> > more than 10% of the sites, some admin under time pressure to Just Fix It
> > assigned FILE privs to get the web application back up and running.
>
> I find it's more common that they just have the application log in as
> MySQL root.  It's foolish.  It happens more frequently than you'd like
> to admit.  Makes my app pentests easier though. ;-)
All true, but then we don't have a program flaw, we have a config flaw.  If you 
run your web applications with root privileges on the database, you should be 
surprised when your app gets exploited.

The question I have for the OP is whether or not he's found a true bug in mysql 
or simply exposed one of the millions of ways to exploit stupidity.

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/