0

Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg

http://xyz.com/fetch?id=3 Consider id parameter is used at server side by cursor library to execute mysql query and no sanitisation is being done. Would something like 3' union select '../../x.py' -- be able to give attacker x.py file which is not part of database?

For better reference to the problem (Flag 0): https://dev.to/caffiendkitten/hacker101-ctf-photo-gallery-4foi

Improve this question

2 Answers 2

Reset to default
1

SQL Injection can lead to Remote Code Execution in some scenarios. As you can see in this article, it is possible to read files from the Operating System, that are "outside the database".

Tools like sqlmap can help an attacker spawn reverse shells while performing a similar attack. Once an attacker has a shell, depending on the permissions of the user and if privilege escalation is possible, one can potentially take over a server.

Improve this answer
2
  • So it's scenario dependent if union based injection can be used to extend access to files not in database?
    – Ryuzaki
    Jan 8, 2021 at 17:08
  • Yes. Most likely the user running the database must have access to the file, otherwise one cannot access it via SQL injection. That's where privilege escalation comes into place, if an attacker can escalate from dbuser to root, the server is entirely compromised, and this attack is feasible through SQL injection.
    – Filipe dos Santos
    Jan 8, 2021 at 17:40
1

Yes, this is possible e.g. with the LOAD_FILE() function available in both MySQL and MariaDB. However, the statement on both sides of the UNION must return the same amount of columns. If there are e.g. four columns before the UNION you could use something like:

' UNION SELECT 1, load_file('../../x.py'), 3, 4' --
Improve this answer
1
  • I'm aware of that method. However from reference link in the question, to find Zeroth flag, author didn't use load function and was able to pull main.py by directly union it with wrong id. I'm confused if it's internal behavior of mysql to allow it
    – Ryuzaki
    Jan 10, 2021 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .