From: Brendan Dolan-Gavitt (mooyix@gmail.com)
Date: Fri Aug 18 2006 - 11:04:06 EDT
You should be able to use SELECT ... INTO OUTFILE to write the results
of a SELECT statement out to a file on the server's filesystem. Since
you can SELECT things that don't actually reference any table, this
should let you write arbitrary data to the filesystem with the
permissions of the database user.
Since it uses PHP, I would try to find a writable, web-accessible
directory on the server and do something like
SELECT '<?php some_evil_php_code ?>' INTO OUTFILE '/var/www/accessible_by_db/';
Have fun :)
-Brendan
On 8/17/06, DokFLeed <dokfleed@dokfleed.net> wrote:
> I am testing a web application, I can run UPDATE & SELECT
> Does anyone know a way to upload a file to a server through MySQL !
> does it allow running system commands or a way to dump a file from the
> database to the server?
> its LAMP , Linux, Apache, MySQL, PHP
> any ideas!!
>
> Dok
> smoke dope, eat soap, fly home in a bubble
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ------------------------------------------------------------------------
>
>
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:46 EDT