Omer Gull - SELECT Code Execution FROM Using SQLite
Demonstrates arbitrary code execution achievable through malicious SQLite queries, requiring only a SQL injection primitive in any SQLite-backed application.
Summary
SQLite Code Execution via SQL Injection
Omer Gull (Security Researcher, Checkpoint Research) presents research demonstrating that arbitrary code execution is achievable through carefully crafted SQL queries against SQLite databases, transforming SQL injection into immediate code execution.
SQLite Virtual Tables as Attack Vector
SQLite's virtual table mechanism allows registering C callback functions that execute when virtual tables are queried. While the built-in virtual tables (FTS, R*Tree) are sandboxed, memory corruption vulnerabilities in these implementations allow escalating SQL injection to memory corruption.
Query Planner Exploitation
Gull identifies vulnerabilities in SQLite's query optimizer (query planner) that are triggered by specific query patterns. A malicious SQL query crafted to trigger these bugs achieves heap corruption within the SQLite process.
Universal Impact
Any application with a SQL injection vulnerability against a SQLite backend is immediately vulnerable to code execution via this technique — iOS apps, Android apps, macOS/iOS OS components (SQLite is deeply embedded in Apple platforms), and any backend application using SQLite.
Related talks
Main Stage·39 min
Wenxiang Qian
Achieves remote code execution on Google Home smart speakers by chaining SQLite injection with a use-after-free memory corruption vulnerability.
Briefings·36 min
Qibo Shi · Victor V · Wei Xiao · Zhiniang Peng
Diving into Windows HTTP: Unveiling Hidden Preauth Vulnerabilities in Windows HTTP Services (PRE-RECORDED) The Windows operating system heavily relies on HTTP services.
Black Hat·37 min
Ji'an Zhou · Lei Lu · Li'shuo Song
Industry experts analyze emerging threats surrounding Model Files → Memory Corruption → RCE: The Triple-Stage AI Attack Chain.