Hello fellow hackers and hunters, today I’ll be short, about what I’ve found out, a small discovery for me lol.

Some of you may have know it.

While some of you, just like me, probably didn’t know about it.

All of you know this syntax however right ? When you have SQLi just try this and get RCE they said

SELECT '<?php $_GET["x"];' INTO OUTFILE '/var/www/html/myshell.php';

(considering we know the root document / or just by probing get lucky)

Anyways~, during SQLi in real target, we can’t control that string what’s selected (or can we? :D).

And the multi-query case is very~ rare, where you can do, e.g. injecting 2nd query like this 👇️

'; SELECT '<?php $_GET["x"];' INTO OUTFILE '/var/www/html/myshell.php';

because that requires backend to initially use another method (e.g. multi_query(), not the typical query())


So what I discovered is that this syntax also works in SQL :D (not maybe for all DBMS ofc, but MariaDB/MySQL for sure)

SELECT * FROM `users` INTO OUTFILE '/var/www/html/myshell.php';

Same for this

SELECT * FROM `users` WHERE 1 LIMIT 1 INTO OUTFILE...

so any SELECT statement we can finish with “INTO OUTFILE <file>”, and write a file on a server with that selected content

Although interestingly it seems to be deprecated — but was never removed !) (luckily, hope it stays like that for a while, like imo they wanna allow only maybe such syntax

SELECT * INTO OUTFILE ‘…..’ FROM users

cause this would’ve prevented what I’ll reveal further)

See how I tested it below (also notice how it shows red “x”, but actually works lol)


So this behavior (any SELECT … can be written to file) + DB poisoning (idk if such term exists already, if no I just invented one) == RCE

By DB poisoning I mean: find a request, that will populate that exact table column, where you have SQLi, like naturaly (not naturaly lol) apps have insert statements yes ? We can use them and chain to RCE :D

If you are worried, about other junk, 1st of all we can use LIMIT & OFFSET or WHERE in case there are problems with size being too big for write operation to execute

2nd of all: they don’t bother PHP for execution→ try it out now

echo 'junk_kjlansdk<?php system("id");?>junk_8d3gj95' >test  && php test

So: Whenever you have SQLi in SELECT statement → try writing in same table column by another request (e.g. register user to write in ‘users’ table if you have SQLi in select statement for users table)→ then try redirecting output to a file with SQLi, where then you can access, and PWN !)


This required from me just checking the syntax locally to confirm the chain I thought, and it works nicely.

That’s it, see you & happy hacking !


P.S. Maybe I discovered this once, and I just rediscovered it again, anyways, no matter, still this is a chain anyone could’ve missed, unless they were thinking specifically about this goal.