#mysql50# legacy alias / stale table cache identity mismatch
该报告还没有中文解读。
原文摘录
摘自原文(16801 字符中的一小部分)
> **Note:** a working (but heavily vibecoded mess of a) info leak, privilege escalation, and or remote code execution chain for this issue is available. > I recommend not posting anything publicly accessible about this in JIRA until resolved.
原文中的代码
SELECT VERSION(); -- 13.1.0-MariaDB DROP TABLE IF EXISTS t, `#mysql50#t`; CREATE TABLE t(id INT, c1 BINARY(32)) ENGINE=MEMORY; INSERT INTO t VALUES(1, REPEAT(0x41,32)); -- open / cache the wide table definition SELECT 'table-read' AS type, id, LENGTH(c1), HEX(c1) FROM t; -- …
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 MariaDB 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @vortfu · 版权归作者与 MariaDB 所有