1

After finding a sql injection vulnerability I need to provide the more information I can about the DB. Minimum I need to provide a list of users and passwords.

I identified that it's a MySQL but checking information_schema.schemata I notice there are just two databases: information_schema and abc (the one created for the problem).

mysql is missing, so from where can I get the list of users and passwords? As mysql.user is unavailable.

  • Your user may not have administrative access. Successful SQL injection doesn't mean full database server compromise. It just means you can inject data into the DB as that user, if you not admin you will not be able to select this data. – David Houde Dec 3 '14 at 13:04
  • @DavidHoude I understand that, but at least the schema "mysql" should show up in information_schema, shouldn't it? – yzT Dec 3 '14 at 13:06
  • @DavidHoude SQL injection means you can inject SQL commands/fragments. Injecting data requires a data manipulation statement (INSERT, UPDATE, or REPLACE). – Gumbo Dec 3 '14 at 17:11
  • 1
    There is no way for mysql to exist and not to have a "mysql" db. Your user might be blocked like stated in this answer. – DarkLighting Dec 3 '14 at 17:21
  • By the way, did you receive any data from querying information_schema? – DarkLighting Dec 3 '14 at 17:25
1

As DarkLighting said in comments, the mysql schema is always available because it's part of the installation, just as information_schema.

If a user can't see the mysql DB, it means he has no privileges. Likely he has the privilege USAGE. So in order to be able to get the users' credentials, first the attacker should leverage some privilege escalation vulnerability to get root access, and hence, gain access to the mysql DB where the credentials are stored.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.