2

I'm a penetration tester and I'm working on a new website that is vulnerable via SQL injection. This site injects with this payload:

?id=3333' union select 1,2,3,4 --+

Fourth column of second select returns in response.

In addition I'm sure that "db.php" is present at this path:

"var\www\vhosts\mySite.com\httpdocs\lib\db.php"

But I can't read "db.php" content using this injection:

?id=3333' union select 1,2,3,load_file('var\www\vhosts\mySite.com\httpdocs\lib\db.php')

What's wrong with this payload? And DB is MySQL.

  • at first look a '\' seems to be missing var\www\vhosts\mySite.com\ ----> \var\www\vhosts\mySite.com\ – Arjun sharma Oct 30 '16 at 14:11
  • I checked it too. Nothing happens! – Mohammad Azizi Oct 30 '16 at 14:22
  • who owns db.php and are you getting blank screen or null ? – Arjun sharma Oct 30 '16 at 14:46
  • imagine that its not clear who own it. i check its response in a html element and its null. – Mohammad Azizi Oct 30 '16 at 14:49
  • According to w3resource, “The MySQL LOAD_FILE() reads the file and returns the file contents as a string.” To use this function, the file must be located on the host server, user must specify the full path name of the file, and user must have the FILE privilege. The file must be readable and size must be less than max_allowed_packet (set in the my.ini file) bytes. It returns NULL if the file does not exist or can’t be read.“ – Arjun sharma Oct 30 '16 at 14:52
2

As sorted out the missing part was file privileges . As per documentation of LOAD_FILE the user executing the query must have File privileges more over at file system level the file must allow the actions performed by query

LOAD DATA INFILE
  1. For security reasons, when reading files located on the server, the files must either reside in the database directory or be readable by the user account used to run the server.

  2. To use LOAD DATA INFILE on server files, you must have the FILE privilege.

LOAD DATA LOCAL INFILE

Using LOCAL is a bit slower than letting the server access the files directly, because the contents of the file must be sent over the connection by the client to the server.

On the other hand, you do not need the FILE privilege to load local files.

| improve this answer | |
0

The observation may also occur in MySQL versions >=5.7.6 if --secure-file-priv parameter is set when mysql was compiled for the platform.

Please see the official explanation for this parameter here.

Due to this parameter being set, load_file, dumpfile, outfile commands will be unable to perform their respective function. If mysql errors are displayed to the browser, then attempting to use "into dumpfile" to a directory not allowed by the --secure-file-priv parameter will state that an attempt was made to write file outside the --secure-file-priv directory which is not allowed.

Note that the default value of the --secure-file-priv is platform-dependent. To reset the --secure-file-priv directory, have a look at this post which describes the case for a MySQL installation in Ubuntu.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.