Php-mysql-sleep-benchmark injection attacks

Php-mysql-sleep-benchmark injection attacks

Sleep Function

Benchmark Function

Hazards of deposit Injection

If a mysql injection exists and the injected sleep statement is input with a large enough parameter, for example, sleep (9999999999 ). if the database uses the myisam engine and the injection point is a statement that locks the table (insert, replace, update, delete), access to the entire data table will be blocked. if the database uses a Master-Slave separated architecture, the synchronization between the Master and Slave will be blocked by the sleep statement, and the Slave database will not be able to synchronize data normally from the Master database. some applications that depend on master-slave synchronization cannot work normally. even if it is only a read operation, after a limited number of requests, it will quickly reach the database's max_connections limit, leading to database Denial of Service.

Solution

Disable the sleep function of mysql. Or modify its sleep limit to reject excessive sleep. This sleep function is rarely used in reality. Even in scenarios where sleep is required, you can use external applications to implement sleep. configure wait_timeout (recommended value should not be too small (10), otherwise it may encounter problems such as "MySQL has gone away)

The benchmark function works the same way.

See http://www.bkjia.com/Article/201202/119592.html for details