From SQL Injection to Remote Code Execution: Following an Unexpected Attack Chain

The write-up describes a security researcher's journey from exploiting an SQL injection vulnerability to gaining remote code execution (RCE) on a shared hosting server. Here’s a detailed breakdown of the process:

Initial Discovery: SQL Injection Vulnerability

1. Identifying the Vulnerability:

   • The researcher found an SQL injection vulnerability in a web application.
   • They used sqlmap to automate the exploitation and gather information about the database.

2. Gaining Database Access:

   • Using the SQLi, they retrieved the MySQL root password hash from the database.
   • They cracked the password using a wordlist (rockyou.txt) and gained access to the MySQL server as the root user.

Exploiting Further Vulnerabilities

1. Finding Additional Flaws:
   • The researcher discovered another SQL injection vulnerability in the /wp-content/plugins/woocommerce/myaccount-edit.php file.
   • They used this flaw to dump more sensitive information, such as API keys and database credentials for other unrelated websites on the same server.

Escalating Privileges

1. File Upload Exploit:
   • The researcher found a file upload vulnerability in `/wp-content/plugins/woocommerce/myaccount

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.