x.comthreadTanmay (@TanmayK_03) on X
DBHub, a database MCP server, had a read-only mode bypass in its SQL check. The check treated every `--` as a comment, but MySQL only starts a comment when whitespace follows it. A hidden write statement could therefore still run, and a prompt injection could trigger it. Fixed in version 0.22.6. Replies say enforcement belongs in database grants and that parser tests need to be dialect-specific.
TL;DR Thread on a DBHub read-only bypass caused by a SQL filter and MySQL disagreeing on `--` comment syntax, fixed in 0.22.6.
Technologies named here
- MySQL
- Model Context Protocol
- DBHub
- Relay
Techniques named here
- Prompt Injection
- SQL comment parsing bypass
Concepts named here
- Least privilege
- Parser differential
- Read-only enforcement via database grants
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup