endpoint-software-vulnerabilityproof-of-concept-releaseprivilege-escalation-methodpersistence-method

Malicious SQLite Databases Can Trigger Code Execution via Query Hijacking

Vulnerability Disclosure · 1 source · Updated 3mo ago · First seen Aug 10, 2019

Check Point Research disclosed that a crafted SQLite database can be weaponized to achieve code execution by exploiting memory-corruption flaws in the SQLite engine itself, even when an application only performs hardcoded queries against untrusted data. The researchers described two techniques—Query Hijacking and Query Oriented Programming (QOP)—that abuse schema elements such as VIEWs and virtual-table features to redirect execution into attacker-controlled paths without requiring a surrounding scripting environment.

The report demonstrated the approach in two practical scenarios: remote code execution against a PHP7-based password-stealer backend and privileged persistence on iOS by replacing a frequently queried SQLite database. The research also pointed to risky virtual-table modules including FTS and RTREE, referenced earlier issues such as CVE-2015-7036 and CVE-2019-8457, and said Apple assigned CVE-2019-8600, CVE-2019-8598, CVE-2019-8602, and CVE-2019-8577 after responsible disclosure.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · 2019 – Aug 10, 2019

Aug 10, 20197y ago
SQLite research demonstrates SQL-only code execution techniques
Check Point Research published findings showing that a malicious SQLite database can achieve code execution through memory-corruption bugs using SQL-language features alone. The work introduced Query Hijacking and Query Oriented Programming (QOP) and demonstrated remote code execution against a PHP7 password-stealer backend as well as iOS persistence via a malicious contacts database.
SELECT code_execution FROM * USING SQLite; - Check Point Research
2019
Apple assigns four CVEs after responsible disclosure
Following responsible disclosure of the iOS-related findings, Apple assigned CVE-2019-8600, CVE-2019-8598, CVE-2019-8602, and CVE-2019-8577. The reference does not explicitly anchor the date of Apple's assignment beyond the 2019 CVE identifiers.
SELECT code_execution FROM * USING SQLite; - Check Point Research

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

1 reference tracked. Mallory keeps watching after this page renders.

Checkpoint Research BlogNews · Aug 10, 2019

SELECT code_execution FROM * USING SQLite; - Check Point ResearchOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

endpoint-software-vulnerabilityproof-of-concept-releaseprivilege-escalation-methodpersistence-method

Malicious SQLite Databases Can Trigger Code Execution via Query Hijacking

Vulnerability Disclosure · 1 source · Updated 3mo ago · First seen Aug 10, 2019

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · 2019 – Aug 10, 2019

Aug 10, 20197y ago
SQLite research demonstrates SQL-only code execution techniques
Check Point Research published findings showing that a malicious SQLite database can achieve code execution through memory-corruption bugs using SQL-language features alone. The work introduced Query Hijacking and Query Oriented Programming (QOP) and demonstrated remote code execution against a PHP7 password-stealer backend as well as iOS persistence via a malicious contacts database.
SELECT code_execution FROM * USING SQLite; - Check Point Research
2019
Apple assigns four CVEs after responsible disclosure
Following responsible disclosure of the iOS-related findings, Apple assigned CVE-2019-8600, CVE-2019-8598, CVE-2019-8602, and CVE-2019-8577. The reference does not explicitly anchor the date of Apple's assignment beyond the 2019 CVE identifiers.
SELECT code_execution FROM * USING SQLite; - Check Point Research

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

1 reference tracked. Mallory keeps watching after this page renders.

Checkpoint Research BlogNews · Aug 10, 2019

SELECT code_execution FROM * USING SQLite; - Check Point ResearchOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Malicious SQLite Databases Can Trigger Code Execution via Query Hijacking

How this story unfolded

SQLite research demonstrates SQL-only code execution techniques

Apple assigns four CVEs after responsible disclosure

Sources

See the full picture, correlated to your attack surface.

Related stories

SQLite FTS5 Heap Buffer Overflow Patched in CVE-2026-11824

Google AI Model Discovered New SQLite Memory Corruption Flaw

SQLite Session Flaw Lets Malicious Changesets Trigger Heap Out-of-Bounds Writes

Malicious SQLite Databases Can Trigger Code Execution via Query Hijacking

How this story unfolded

SQLite research demonstrates SQL-only code execution techniques

Apple assigns four CVEs after responsible disclosure

Sources

See the full picture, correlated to your attack surface.

Related stories

SQLite FTS5 Heap Buffer Overflow Patched in CVE-2026-11824

Google AI Model Discovered New SQLite Memory Corruption Flaw

SQLite Session Flaw Lets Malicious Changesets Trigger Heap Out-of-Bounds Writes