Search code examples
mysqlsqlsecuritysql-injection

Is it possible to perform SQL injection on a server that is using a database other than MySQL?

If the database used by a server is something other than MySQL, say Mongo DB, then is it possible to execute SQL queries? In such cases how can we perform SQL injection? I don't expect all the possible commands, but some basic commands if the app is using, say MongoDB.

Solution

  • Yes. This type of attack is possible with any data source which parses queries. In the case of MongoDB, the queries are written in JavaScript instead of SQL but if you build your query like this:

     String query = "db.users.find({ age: " + request.getParameter("age") + " });"

    then you open the database to similar kinds of attacks.