Hacker News Reader

This is "ZOMG take action immediately" bad.

- Exploitable by anyone able to access the site

- No mitigation

- Remote code execution

- Stealthy

- Exploits are in the wild

It appears to be a pretty serious issue. The SQL injection alone is bad but the ability to run basically any PHP code through callbacks makes the problem that much worse.

SQL injection alone is often enough to get you RCE if your MySQL account has FILE permissions enabled (often true). Something like `SELECT "<?php eval($_GET['x'])" INTO OUTFILE /srv/www/backdoor.php`.

>(often true)

I don't think it's that often. By default, a new MySQL user will not have FILE privileges granted.

Most of the time you see this due to the developer being lazy and just using the "root" MySQL user.

This would also depend on hilariously bad permissions on /srv/www that allow the mysql user to create files there.

Strong Bad.