5 ms·
OK this is is fun but can anyone describe a scenario where this is actually dangerous...?
by chx 8y ago
OK this is is fun but can anyone describe a scenario where this is actually dangerous...?
- blunte 8y agoFrom the very entertaining article: Summary A mysql exploit created in two hours can generate ~4 rootshells per month.
- penagwin 8y agoThis is dangerous for anyone who connects to random MySQL databases with the default settings of most clients as it allows arbitrary file reads? The segment at risk is almost exclusively black-hat, although maybe you could MiTM a connection....
- larkeith 8y agoMy immediate thought is if an attacker gains control of your MySQL server they could use this to help propagate across the network (and of course grab arbitrary data from everything that connects).
- tyingq 8y agoNo actual MySQL server is involved in this...
- 13of40 8y agoIt would be interesting to see if the client will upload a file from an SMB share using the credentials the client is running under. But I think the main scenario is where the MySQL server is compromised and the attacker wants to pivot to the client machine.