We process a lot of batch files and do an initial batch file import via the LOAD DATA LOCAL INFILE call in MySQL.

Is there a tool / standard out there that can scan or help to mitigate SQL injection from this import process?

  • Could you explain a bit more in which phase of the process you see the possibility of a SQL injection or are you talking about a general approach for SQL injection by using LOAD DATA LOCAL INFILE? – user69377 Jul 30 '15 at 20:36
  • Perhapps I may have not been completely clear on the type of security issue. The problem arises when the file is batch loaded into a table which is then later displayed in the user interface. So really, what im trying to protect against is a stored XSS attack as those values are inserted without being scrubbed. – bobo baggins Jul 30 '15 at 20:53

There are two potential security issues with supporting the LOCAL version of LOAD DATA statements:

  1. The transfer of the file from the client host to the server host is initiated by the MySQL server. In theory, a patched server could be built that would tell the client program to transfer a file of the server's choosing rather than the file named by the client in the LOAD DATA statement. Such a server could access any file on the client host to which the client user has read access.
  2. In a Web environment where the clients are connecting from a Web server, a user could use LOAD DATA LOCAL to read any files that the Web server process has read access to (assuming that a user could run any command against the SQL server). In this environment, the client with respect to the MySQL server actually is the Web server, not the remote program being run by the user who connects to the Web server.

All the sources I found MySQL, Symantec and Green SQL recommend to disable this function. However if you are using in a controlled environment (restricted access only to trusted users) you might accept the risk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.