Security Issues With LOAD DATA LOCAL

• The LOAD DATA statement can load a file that is located on the server host.
  • It can also load a file that is located on the client host when the LOCAL keyword is specified.

• There are two potential security issues with supporting the LOCAL version of LOAD DATA statements:
  • Potentially a server could access any file on the client host to which the client user has read access.
  • In a Web environment where the clients are connecting from a Web server, a user could use LOAD DATA LOCAL to read any files that the Web server process has read access.

• The two potential security issues can be avoided by disabling all LOAD DATA LOCAL commands from the server side.
  • Start mysqld with the --local-infile=0 option. read access.

• If LOAD DATA LOCAL INFILE is disabled, either in the server or the client, a client that attempts to issue such a statement receives the following error message:

  ERROR 1148: The used command is not allowed with this MySQL version

How do I run MySQL as a normal user?

---

---

© 2007 John Michael Pierobon

Notes