Using SQLite Vulnerabilities to Exploit a Password Stealer

Check Point Research recently discovered an innovative method of exploiting SQLite bugs. For more information visit research.check...
Recent research in hacking discovered that simply querying a database may not be as safe as you expect. Using our innovative techniques of Query Hijacking and Query Oriented Programming, we proved that memory corruption issues in SQLite can now be reliably exploited. As our permissions hierarchies become more segmented than ever, it is clear that we must rethink the boundaries of trusted and untrusted SQL input. To demonstrate these concepts, in this video we achieved remote code execution on a password stealer back-end running PHP7.