MySQL is an open-source relational database management system.

learn more… | top users | synonyms

3
votes
2answers
76 views

securing unpatched websites

I have a client with a lot (read several thousand) websites in several old cms solutions that are no longer maintained. Now moving all of them to a maintained solution isn't really an option at this ...
3
votes
1answer
84 views

Why is this SQL Injection attempt failing on DVWA?

I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID ...
3
votes
0answers
143 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
3answers
1k views

Anonymiszing sensitive data in MySQL DB while retaining searchability [closed]

I have a MySQL database that stores sensitive (personal) data about individuals; and have been tasked with ensuring that this data is encrypted in some way to protect the individuals and their data if ...
3
votes
0answers
1k views

Where to store sensitive client details (MYSQL DB credentials) [duplicate]

I have a security related question about storing some client information - specifically their database login credentials. My app works based on the client and so the database details need to be set ...
2
votes
1answer
248 views

is root@localhost the same as Unix root with GUID = 0 and ID = 0?

Is a Mysql root user (root@localhost) the same as the computer root account (GUID = 0, ID = 0) ? I mean, is it the root which is executing the script? How can I know if the users are the same?
2
votes
2answers
207 views

Is giving out login information to a read-only mysql database to the public a security threat?

I was looking to give out login information to a read-only mysql database (via phpmyadmin) to the public (the users of my program) to use for reference purposes on a production environment. Would I be ...
2
votes
2answers
3k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
2
votes
1answer
117 views

Using MySQL in .NET and other easily-decompiled languages?

How would people use MySQL in C#, or really any other managed application? Couldn't someone simply decompile the application and find out the password/etc. for the database?
2
votes
3answers
650 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
2
votes
3answers
624 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
2
votes
2answers
967 views

Preventing SQL Injections

So I'm pretty new to SQL so I'm not too familiar with how to prevent any SQL injections. I have 1 main form that's being used as a poll and it currently only has 1 text field. At the moment I think I'...
2
votes
2answers
7k views

How to improve performance of encrypted MySQL database on Linux backend server?

Is ezNcrypt's transparent encryption technology the only way to get a big boost in performance? Are there other good solutions out there we could be looking at for encrypting the entire database with ...
2
votes
2answers
5k views

MySql root password stored in .my.cnf

Before launch of a project, I reset the server's mysql root password. The colo that is hosting project wants the server's root database password stored in the .my.cnf file, in plain text, with the ...
2
votes
2answers
156 views

What are the dangers of sql injection with php?

I made an SQL-injectable web-app build to with PHP to get a better understanding of what is going on and automated it all with sqlmap. The relevant code is the following: mysqli_query($conn, SELECT ...
2
votes
1answer
76 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
2
votes
2answers
955 views

Suspicious entries in MySQL database from user input forms - sql injection?

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'. Five days ago I discovered that there were 222 entries in a table in my database that ...
2
votes
3answers
173 views

A scammer placed a remote file on a Wordpress website?

A previous developer I have used has got upset and start compromising the files of my website on daily bases (such as changing the index of the site with weird messages, deleting the .htaccess, ...
2
votes
2answers
625 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
2answers
113 views

Is this logic security / performance wise or not?

Each physical user will have about 20 tables in the database. When a new user registers, another 20 tables will be created with access only for their new MySQL account. Data does not have to be ...
2
votes
1answer
2k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
2
votes
2answers
398 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
2
votes
1answer
1k views

Are there HIPAA requirements to encrypt our database hosted in AWS

I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS. Do we need to encrypt the MySQL database in order to keep HIPAA ...
2
votes
3answers
593 views

MySQL database access prevention

I am doing a PHP website for a client who deals with third party financial information, and he is concerned about the developmers (me) having access to all the information, which is obviously a valid ...
2
votes
1answer
965 views

sql injection: use WHERE statement in address bar

How can i use "Where" statement during an sql-injection attack in address bar ? for example: ... from+information_schema.TABLES+where+TABLE_SCHEMA+=+XXXX-- The code above does not work.
2
votes
2answers
394 views

How to properly secure OO PHP CMS?

I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
2
votes
2answers
2k views

can anybody explain error based sql injection attacks

I practice about error based sql injection but there isn't any good reference for it .. for example :) : mysql> select count(*),floor(rand()*2) as a from users group by a; ERROR 1062 (23000): ...
2
votes
1answer
352 views

Securing Publicly Exposed MySQL Database for Group CS Project

Hello I am looking for some advice. For an Advanced C++ Programming Course I am taking another student and doing a project. For this project we plan on using a MySQL Database as our backend database.I ...
2
votes
2answers
4k views

How to deal with MySQL's Errcode 13 when trying to write a shell

My attack machine is running Kali and the server is running CentOS 6.4 with DVWA. I'm trying to write a shell through an SQL injection. The payload is ' UNION SELECT '', '<?PHP system($_GET["cmd"...
2
votes
1answer
551 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
2
votes
1answer
793 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
2
votes
1answer
97 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
2
votes
2answers
98 views

Opening remote MySQL database to office IP address at default MySQL port risks?

I read a few questions regarding this topic that were pretty informative, but still wanted to pose my particular case. My company wants to put our data in the MySQL tables we have through our web ...
2
votes
1answer
330 views

Using INTO OUTFILE with INSERT

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and ...
2
votes
1answer
291 views

Learning ethical SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use ...
2
votes
1answer
264 views

/WEB-INF/web.xml showing MySQL credentials?

I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains: <database> <jndi-name>jdbc/mysql</jndi-name> <driver> <type>...
2
votes
1answer
323 views

Can we reverse engineer binlog with row format to make MySQL AES_ENCRYPT visible?

Suppose if I am using the mysql database based encryption using AES_ENCRYPT function & insert records, is it possible to decode the row formatted binlogs generated by MySQL to obtain the actual ...
2
votes
2answers
142 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
2
votes
0answers
142 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
2
votes
1answer
105 views

Secure MySQL data on hosted 3rd part server

I have an application that stores sensitive PII and financial data, and is hosted on a 3rd party server (typical web host). Anything sensitive is encrypted as it goes into the database, and I have no ...
2
votes
1answer
166 views

REST API - XSS prevention - When and how?

I am currently developing a REST API with Java EE and MySQL, it will feed Data to a Android App. The Data comes from an AngularJS Frontend. So my questions are, when: When do I escape the data? Before ...
2
votes
1answer
52 views

Is it a security concern if MySQL manipulates parameter types?

This is a follow up to a question I posted on Stack Overflow but you don't need to read that question - I'm recapping the pertinent details here. I'm testing a PHP application which uses a MySQL ...
1
vote
4answers
7k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
1
vote
2answers
132 views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
1
vote
3answers
323 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
1
vote
1answer
374 views

MySQL/CGI: password in C source file unsafe?

Is this line bad practice from a security stance? connect = mysql_real_connect(connection, "host", "user", "password", "database", 0, (const char *)NULL, 0); If so, what solution would you use? ...
1
vote
2answers
242 views

Do these mysql and ssh issues mean my rails server was hacked?

I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
1
vote
2answers
732 views

How a database connection makes mysqli_real_escape_string more secure?

I am learning PHP+MySQL and observed that mysqli_real_escape_string function in PHP requires a identifier to a MySQL connection. From some research I found that it has something to do with charset and ...
1
vote
1answer
59 views

Amazon RDS MySQL SSL connection, is the password sent in clear?

I am testing Amazon RDS MySQL and I want to connect to MySQL instance using SSL. It works pretty well, but there is something that is not clear to me: reading the FAQs (https://aws.amazon.com/rds/faqs/...
1
vote
2answers
1k views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...