3 ms·
how bad is this?
by tbarbugli 12y ago
how bad is this?
- philo23 12y agoIt appears to be a pretty serious issue. The SQL injection alone is bad but the ability to run basically any PHP code through callbacks makes the problem that much worse.
- mappu 12y agoSQL injection alone is often enough to get you RCE if your MySQL account has FILE permissions enabled (often true). Something like `SELECT "<?php eval($_GET['x'])" INTO OUTFILE /srv/www/backdoor.php`.
- meowface 12y ago>(often true) I don't think it's that often. By default, a new MySQL user will not have FILE privileges granted. Most of the time you see this due to the developer being lazy and just using the "root" MySQL user.
- Ded7xSEoPKYNsDd 12y agoThis would also depend on hilariously bad permissions on /srv/www that allow the mysql user to create files there.
- TacticalMalice 12y agoThis is "ZOMG take action immediately" bad. - Exploitable by anyone able to access the site - No mitigation - Remote code execution - Stealthy - Exploits are in the wild
- grey-area 12y agoStrong Bad.