Collected research
ReDisclosure: New technique for exploiting Full-Text Search in MySQL (myBB case study)
MySQL boolean-mode full-text search operators form a matching language that escaping, prepared statements and scanner rules do not treat as injection. Smuggling them into a full-text search turns the redirect-versus-error difference into an oracle that brute-forces hidden strings character by character, shown on MyBB to read deleted thread titles.
Record
- Published by
- Exploit Azerbaijan
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Exploit Azerbaijan, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .