是否可以通过 SQL 注入的方式使用 MySQL 写入文件？
长话短说，我们在我们的服务器上发现了推销处方药的文件，但我们并没有放在那里。 Windows服务器有非常旧的应用程序并运行MySQL 5.1.11。
除了其他安全缺陷之外，SQL 注入是否可以用于将文件写入服务器文件系统？我确信其中一些旧应用程序很容易受到 SQL 注入攻击。我不认为这是可能的，但我似乎记得在某处读到MySQL可以访问“命令行”并通过它写入文件，尽管我无法找到该信息的来源。话又说回来，我的思想可能在欺骗我。
如果可以的话，是否有可以禁用它的设置？
另外，我并不是在寻找消除 SQL 注入漏洞的答案。虽然这显然需要完成；我正在寻找一种快速的短期修复方法，以防止在修复 SQL 注入漏洞时恶意文件再次神奇地出现。修复所有旧应用程序将花费大量时间。
谢谢。
Long story short, we found files promoting prescription drugs on our server that we didn't put there. The Windows server has very old applications and runs MySQL 5.1.11.
Beyond other security flaws, could SQL injection be used to write files to the server file system? I am certain that some of these old applications are vulnerable to SQL injection attacks. I would NOT think that this is possible, but I seem to remember reading somewhere that MySQL could access the "command line" and write files via it though I can not locate a source for that info. Then again, my mind could be playing tricks on me.
If this is possible, is there a setting that can disable it?
Also, I'm not looking for the answer that says get rid of the SQL injection vulnerability. While that obviously needs to be done; I'm looking for a quick short term fix that will prevent the rogue files from magically appearing again while the SQL injection vulnerabilities are being fixed. Fixing all the old applications is going to take lots of time.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是可能的，尤其是在配置适当粗心的情况下。
例如，有
SELECT ... INTO OUTFILE 'file_name '但这也更有可能是一个不同的安全问题。我会认真考虑快速让软件离线，特别是如果数据库包含任何机密或私人信息
It's possible, especially with suitably careless configuration.
For example, there is
SELECT ... INTO OUTFILE 'file_name'But it's also more likely to be a different security problem. I'd seriously consider taking the software offline quickly, especially if the database contains any confidential or private information
正如科林·皮卡德所表明的那样，是的。
但即使您无法更新您的应用程序，我怀疑它是否需要当前运行的权限。您需要检查登录 mysql 的用户并将这些权限降至最低。特别是在这种情况下，如果您的应用程序不读取/写入存储在 mysql 服务器上的文件，您应该删除 FILE 权限。
as Colin Pickard shows, yes.
but even if you can't update your application, i doubt it needs the rights it's currently running with. you need to check the user it logs in to mysql with and trip those permissions down to the minimum. specifically in this case, you should remove the FILE privilege if your app does not read/write files stored on the mysql server.
将 Web 帐户的应用程序目录的权限设置为只读可能会起作用。这假设您尚未在其中创建文件（例如日志文件等）。
Setting the permissions of the application directory to read-only for the web account might work. This assumes that you're not already creating files in it like logfiles and such.