Why the mysql user should have a mysql database privileges if it's very dangerous.
if my code is vulnerable to SQL Injection and the user have the privileges the attacker can upload directly his backdoor using INTO OUTFILE function, so how mysql privileges work ?

  • The wording is difficult to understand. Can you re-word your questions? What privileges? MySQL database privileges? OS privileges? – schroeder Oct 9 '16 at 15:10
  • MySQL database privileges – Sec Researcher Oct 9 '16 at 15:19
  • Still confused. What do you think the mysql user should have instead? – schroeder Oct 9 '16 at 15:37
  • This question is probably prompted by CVE-2016-6662 combined with a lack of understanding of the point that the mysql (system) user must have filesystem read access to all and write access to most of the files related to MySQL. MySQL should not be able to create configuration files using SELECT ... INTO OUTFILE that it might subsequently mistakenly read as a configuration file, but that is fundamentally unrelated to permissions. It's a design problem with the files the server software is willing to read/write, and from where. – Michael - sqlbot Oct 9 '16 at 21:58

Fundamentally, most software these days is going to have a way of persisting data.

Normally persistence involves using a database system such as MySql.

The simple answer to your question is you cannot avoid it. But you can do things to mitigate and weaken the possible impacts of an attack.

Firstly, treat all user input as hostile. Sanitize and clean it before use. Second, act on the principle of least privilege. This means that if you have a search query that only needs to select from an indexed search table. Only give the user select permissions on that particular table. Don't grant it all permissions on all tables because if an injection vulnerability is found... SQL map cough. Then suddenly they can do pretty much what they want and sniff all of your tables out and extract lots of sensitive data.

| improve this answer | |

Even if you have an SQL injection flaw in your code and the privileges of the db user allow SELECT INTO (and what prevents you to remove that privilege?) this doesn't mean that the user can upload a back door. In order to successfully install a back door the mysqld daemon would need a lot more, like write privileges in one of the directories that is used by the web server for php file execution, for instance. Or 2 or more additional flows like local file inclusion. If your web server is configured properly, this won't be the case. Just uploading a file doesn't help an attacker if he can't execute it.
But in general, of course the user that connects to the DB for reading and updating data should have minimal permissions, like all users shouldn't have more permissions than they need to do their job.
So the summary is that SQL injection and permission to SELECT INTO alone is not enough to compromise a box. On the other hand, minimal permissions for everyone are always a good thing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.