I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server.
Is it possible to somehow locate the root directory using a SQL query?
If you have permissions to write files, you probably have permission to read them, too.
I'd start from reading web server configuration files, e.g.
SELECT * LOAD_FILE('/etc/apache2/apache2.conf');
SELECT * LOAD_FILE('/etc/nginx/nginx.conf');
However, it's not guaranteed that the MySQL has permissions to write to the document root.