2

It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does not require any special privilege.

My question is: does MySQL include any functions except SLEEP() which have all of the following properties?

  1. The function is not commonly required by web applications. Say, 95% of CRUD apps don't need to use the function.

  2. The function is not provided by an external plugin, but is included in the core MySQL codebase.

  3. The function does not require any special privileges to be executed.

  4. The function provides some non-zero benefit to attackers in a SQL injection.

My motivation for the question: I am interested in techniques to prevent SQL injections by limiting MySQL functionality. I am curious if SLEEP()-injections are the only candidate for this technique or if there are other attacks that could be prevented.

Improve this question
0

1 Answer 1

Reset to default
3

You are looking in a bad way. Those security limits can get back to bite you.

The right solution is to sanitize user input etc. to prevent injection to happen.

SQL Injection isn't an error on the database side instead it is on the application side.

If you try to protect only db somebody will attack the app server and once there he can do full dump.

Improve this answer
6
  • Validation is the first line of defense, certainly, but if I know my application won't use SLEEP what harm is there in disabling the functionality? That way life is a bit harder for the attacker in the event I made a mistake in my validation, right?
    – Elliot Gorokhovsky
    Apr 17, 2019 at 21:42
  • 1
    DROP TABLE very_import_data; will have much worse effect on your application than SLEEP(). And you certainly can't or shouldn't disable DDL. So why are you worried about SLEEP or other functions?
    – ypercubeᵀᴹ
    Apr 17, 2019 at 21:49
  • I am not eligible to decide since I don't know the full code of MySQL but most of non-enduser's functions are used in the system. So disabling them may have unexpected results.
    – Aroly7
    Apr 17, 2019 at 21:50
  • 1
    @ypercubeᵀᴹ Realy DROP would require DROP PRIVILEGES which aplication user mostly don't have. Biger fun is something like UPDATE 'ORDERS' SET id=0 WHERE id IS NOT NULL;
    – Aroly7
    Apr 17, 2019 at 21:55
  • 1
    DELETE FROM orders; can be equally devastating, true.
    – ypercubeᵀᴹ
    Apr 17, 2019 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.