Details
Critical Description
When executing a query with a NUL byte ('\0') in it, SHOW PROCESSLIST will just show the query up to that byte, hiding the rest of the query. In the slow query log, on the other hand,
the full query is shown, and the NUL byte encoded as '^@'.
This can be used by a malicious user to try to hide SQL injection attacks.
<?php
|
$db = mysqli_connect("127.0.0.1", "root", "", "test");
|
$query = "SELECT user FROM mysql.user WHERE user = 'root\0' OR SLEEP(100)";
|
$db->query($query);
|
?>
|
> show full processlist;
|
+----+-------------+-----------------+------+---------+------+--------------------------+------------------------------------------------+----------+
|
| Id | User | Host | db | Command | Time | State | Info | Progress |
|
+----+-------------+-----------------+------+---------+------+--------------------------+------------------------------------------------+----------+
|
[...]
|
| 17 | root | localhost:41928 | NULL | Query | 0 | Init | show full processlist | 0.000 |
|
| 18 | root | localhost:41930 | test | Query | 2 | User sleep | SELECT user FROM mysql.user WHERE user = 'root | 0.000 |
|
+----+-------------+-----------------+------+---------+------+--------------------------+------------------------------------------------+----------+
|
Time Id Command Argument
|
# Time: 190902 12:22:03
|
# User@Host: root[root] @ localhost [127.0.0.1]
|
# Thread_id: 18 Schema: test QC_hit: No
|
# Query_time: 300.028394 Lock_time: 0.001831 Rows_sent: 0 Rows_examined: 3
|
# Rows_affected: 0 Bytes_sent: 70
|
use test;
|
SET timestamp=1567419723;
|
SELECT user FROM mysql.user WHERE user = 'root^@' OR SLEEP(100);
|
Attachments
Issue Links
- causes
-
MDEV-21462 main.processlist_notembedded fails to clean up, causes perfschema test failures
-
- Closed
-
- relates to
-
-
- Closed
-
