MySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Write

The MySQLSelectTool in Neuron (versions ≤2.8.11) [1] is intended as a read-only SQL query tool for AI agents. However, its validation logic, which checks only the first SQL keyword (e.g., SELECT) and a blocklist of forbidden keywords, fails to prohibit file-writing constructs such as INTO OUTFILE and INTO DUMPFILE [2][3].

An attacker who can influence the tool's input—for example, through prompt injection against a public-facing agent endpoint—can inject SQL statements that include SELECT ... INTO OUTFILE [3]. Exploitation requires that the MySQL/MariaDB account has the FILE privilege and that the secure_file_priv variable permits writing to a directory accessible by the application (e.g., a web root) [3].

Successful exploitation allows the attacker to write arbitrary content to files on the database server. If the written file is a PHP web shell placed in a web-accessible directory, this can lead to remote code execution on the application host [3].

The vulnerability is fixed in Neuron version 2.8.12 by adding 'INTO', 'OUTFILE', 'DUMPFILE', and 'LOAD_FILE' to the forbidden statements list [4]. As a workaround, administrators can disable the MySQLSelectTool for agents exposed to untrusted input, ensure the database account lacks FILE privilege, or restrict secure_file_priv to a non-web-accessible directory [3].