Other nomination
MySQL Stacked Queries with SQL Injection...sort of
Shows how to get stacked-query effects out of a MySQL SELECT injection, which normally allows only one statement. Using INTO OUTFILE the attacker writes the .TRG and .TRN trigger definition files straight into the database data directory, so MySQL loads and fires an attacker-written trigger on the next insert, yielding privilege escalation, stored XSS and data modification.
Record
- Researcher
- Stefano Di Paola
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host.