Tag Info

New answers tagged

2

In this particular example there's very little you could do, even if you hadn't magic_quotes. That's because a SQL injection normally can only add to the query string. Since the string is an INSERT command, you can only INSERT something. In theory, if the SQL server behind supported "chained commands", you could transform a command in two: INSERT INTO ... ...


1

That SQL injection don’t work on your server may be due to magic quotes, which escape certain characters in incoming data with backslash escape sequences: […] all ' (single-quote), " (double quote), \ (backslash) and NULL characters are escaped with a backslash automatically. This is identical to what addslashes() does. These are exactly the characters ...


1

Could it? Yes. Is it? That's less certain. If your MySQL server is configured properly, it isn't accessible from the Internet at large, and the credentials are useless to anyone who doesn't have the ability to run code on the server. Of course, this assumes that the username and password are unique to the server.


5

Yes, of course is a potential security threat. MySQL can always have a vulnerability in it, perhaps something like CVE-2003-0150 MySQL Root Privilege Escalation Vulnerability from many years ago. New flaws can be introduced with any update, and old flaws can be discovered at any time. Just because you ask MySQL not to let the user run or create anything ...


3

Would I be risking anything on my side by doing so? yes. ... Even if the system is 'secure' (i.e. no priv esc vulnerabilities as the other guy correctly mentioned - you're making access easy for that kind of thing) they can DoS your system with expensive queries. I'd also make sure you definitely lock down all privileges to ruin fun like …’ UNION ...


0

Yes, You can write your shell onto the web server with SQL statements without logging into the admin panel or any other control panel. But for this you have to met certain requirements. 1.Your must have write privileges and a writable directory (where you have to upload your shell) 2.Root Path (i.e /var/www/website/) 3.Magic Qoutes must be enabled Now ...


0

I know I am three years late to the party, but I like to point out something I missed in the answers for those finding this in Google. Most "leaks" from hacked websites are the result of SQL Injection, and much less from a root-ed server where the hacker has full access to the raw database files. SQL injection is an attack technique where the hacker can ...


1

The blog post at Portcullis security seems to be saying that you have to hash the 12-byte "salt" with SHA1 to turn it into a 20-byte string before prepending it to the hashed password.



Top 50 recent answers are included