Hacker News Reader

The point is that it is exploitable from SQL, therefore is also exploitable from the application that is creating the database.

This would be a target for a sql injection exploit and so is remotely exploitable

View on HN

That requires your application to be vulnerable to two types of exploit in order to pull off RCE - if you are vulnerable to SQLi there are likely a whole raft of other issues which would give you a remote shell.

As a standalone issue I agree with the GP comment - this bug is not a RCE issue, it's privilege escalation.

I'm sorry I disagree , you're assuming that the "application" is vulnerable to sql injection and others.

Reply on news.ycombinator.com