Disable local_infile setting in MySQL
Arbitrary files can be read from the system using LOAD_DATA unless this setting is disabled.
Impact
Arbitrary files read by attackers when combined with a SQL injection vulnerability.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Disable the local infile setting
1
2
3
4
5
6
7
8
9
10
11
12
|
resource "google_sql_database_instance" "db" {
name = "db"
database_version = "MYSQL_5_6"
region = "us-central1"
settings {
database_flags {
name = "local_infile"
value = "off"
}
}
}
|
Links