Select Code_execution from * Using SQLite; (2019)

Re:Select Code_execution from * Using SQLite; (2019) by ysleepy on Saturday June 13, 2020 @02:32PM (#23511536)

The exploit works with any query performed on the sqlite db file.

The expected tables are replaced by views that execute the arbitrary sql.

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by SQLite on Saturday June 13, 2020 @03:18PM (#23511910)

The attack is clever and original. AFAIK, nothing like it has ever been seen before.

Since this attack came to light, SQLite has added features so that an application can ensure that views and triggers do not have side-effects (outside of the database file itself). And if there are no side-effects then the attack is basically harmless. Sure, the attacker can still exfiltrate or corrupt data, but the attacker had to have write access to the database file in order to carry out the attack in the first place, so exfiltrating or corrupting data is not an issue - they could already do that. See a quick summary at https://sqlite.org/forum/forumpost/8beceed68e

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by Drip33 on Saturday June 13, 2020 @03:23PM (#23511938)

Was the write a shell php file portion of the video/exploit patched?

Sites like https://sqliteonline.com/ and https://inloop.github.io/sqlite-viewer/ could be perpetually vulnerable if not?

[ Parent | on HN ]