DEF CON 32 - SQL Injection Isn't Dead Smuggling Queries at the Protocol Level - Paul Gerste

SQL injection isn't dead—attackers can exploit binary database protocols through integer overflows and truncation bugs 2:40.

Key Takeaways:
• PostgreSQL and MongoDB client libraries suffer from integer overflow truncation in 4-byte length fields, enabling SQL injection via oversized payloads 7:00.
• Attackers can inject full SQL statements (e.g., insert admin users) by crafting large payloads that trigger parsing errors and message desyncs 9:40.
• Exploits are feasible in real-world apps like Harbor and Grafana, especially when input size limits are disabled or bypassed via compression or SSRF 28:00.
• Language differences matter: Go, Python, and Rust allow large payloads; Java and JavaScript have limitations due to integer overflow behaviors 31:00.

This vulnerability demonstrates that SQL injection remains a real threat, even in applications using modern, secure coding practices—attackers simply go deeper into the protocol layer.

Sources:

• 2:40 Discussion of integer overflow in binary protocols and its relevance.
• 7:00 Technical breakdown of PostgreSQL truncation vulnerability.
• 9:40 Demonstration of SQL injection via message desync in PostgreSQL.
• 28:00 Real-world exploit scenarios including SSRF and compression bypass.
• 31:00 Language-specific behavior of integer overflows and payload handling.