Blind SQL Injection in WsgiDAV MySQLBrowserProvider

The WsgiDAV project contains a sample module named MySQLBrowserProvider that is vulnerable to blind SQL injection (CVE-2026-55509). The vulnerability stems from improper input sanitization where the record key provided in a URL request is directly concatenated into a SQL WHERE clause. While the provider is not enabled by default, deployments that explicitly configure it to back a share are exposed.

Because the provider performs an existence check during standard GET requests, an attacker does not require authentication or write access to exploit the flaw. By injecting SQL conditions into the URL path, an attacker can use a boolean status-code oracle - where a successful query result or error returns a 500 status and a non-existent record returns a 404 - to perform bit-by-bit data extraction from the backing database. This allows for the exfiltration of sensitive table data reachable by the database user account configured in the provider.

Attack Chain

1. Attacker identifies a WsgiDAV instance exposing a share backed by MySQLBrowserProvider.
2. Attacker crafts a malicious URL path formatted as /db/<table_name>/<injected_sql_key>.
3. Attacker uses a boolean SQL injection payload, such as 0' OR (SELECT ASCII(MID((QUERY),1,1))>100) OR '1'='2 in the key parameter.
4. The MySQLBrowserProvider receives the request and concatenates the injected string directly into the SELECT id FROM table WHERE id = '<injected_key>' query.
5. The backend database executes the injected SQL.
6. The application returns an HTTP 500 if the injected condition is true (due to internal state handling) or an HTTP 404 if false.
7. Attacker iteratively automates these requests to exfiltrate arbitrary data from the database.

Impact

Successful exploitation leads to unauthorized access and exfiltration of sensitive information contained within the MySQL database linked to the WsgiDAV share. The scope of impact is limited to the privileges of the database user configured in the provider. As this is an unauthenticated vector on any share using the provider, it represents a high risk for data confidentiality in affected deployments.

Recommendation

Prioritize the remediation of any WsgiDAV instance utilizing the MySQLBrowserProvider.

• Disable the MySQLBrowserProvider module in the WsgiDAV configuration if it is not strictly required.
• Upgrade WsgiDAV to a version where this vulnerability is resolved.
• Implement access control lists (ACLs) or web-level authentication for any share using the MySQLBrowserProvider to prevent unauthenticated access.
• Review web access logs for requests to paths matching /db/*/* containing SQL syntax characters (e.g., ', --, UNION, SELECT).