{"guid":"b5c2b975-b007-421a-bd58-d5a51ebbd5d5","title":"How to Hack \"Read-Only\" SQL MCP Servers Online (Fast)","subtitle":null,"slug":"god2026-110757-how-to-hack-read-only-sql","link":"https://c3voc.de","description":"Chat Bots und AI Agents werden immer mehr produktiv eingesetzt. Oft sollen diese mit einer SQL Datenbank interagieren können. Wenn lediglich Daten gelesen, aber nicht verändert werden sollen, scheint es sinnvoll einen \"Read-Only\" SQL MCP Server dafür zu verwenden. Doch was wenn dieser doch nicht so \"Read-Only\" wie versprochen ist und zum Beispiel der Chatbot zur Kundenberatung auf einmal dazu benutzt werden kann die Preise von Produkten oder Passwörter von Benutzern zu ändern?\n\nIch habe 19 \"Read-Only\" SQL MCP Server untersucht und in 18 innerhalb von je 30 Minuten Schwachstellen gefunden; so \"Read-Only\" waren diese dann doch nicht...\n\nLicensed to the public under https://creativecommons.org/licenses/by-sa/4.0/","original_language":"deu","persons":["Maximilian Hildebrand"],"view_count":2,"promoted":false,"date":"2026-09-24T15:10:00.000+02:00","release_date":"2026-09-24T00:00:00.000+02:00","updated_at":"2026-09-24T16:55:04.667+02:00","tags":["110757","2026","god2026","Saal Baden","god2026-deu","god2026","Day 1"],"length":1519,"duration":1519,"thumb_url":"https://static.media.ccc.de/media/events/god/2026/110757-b5c2b975-b007-421a-bd58-d5a51ebbd5d5.jpg","poster_url":"https://static.media.ccc.de/media/events/god/2026/110757-b5c2b975-b007-421a-bd58-d5a51ebbd5d5_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/god/2026/110757-b5c2b975-b007-421a-bd58-d5a51ebbd5d5.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/god/2026/110757-b5c2b975-b007-421a-bd58-d5a51ebbd5d5.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/god2026-110757-how-to-hack-read-only-sql","url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_title":"German OWASP Day 2026","conference_url":"https://api.media.ccc.de/public/conferences/god2026","related":[],"recordings":[{"length":1519,"mime_type":"video/mp4","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-24T16:23:29.199+02:00","label":"deu 1080p","size":220,"recording_url":"https://cdn.media.ccc.de/events/god/2026/h264-hd/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_hd.mp4","url":"https://api.media.ccc.de/public/recordings/105399","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"audio/mpeg","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-24T16:36:31.019+02:00","label":"deu","size":23,"recording_url":"https://cdn.media.ccc.de/events/god/2026/mp3/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/105409","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"audio/opus","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2026-09-24T16:36:34.629+02:00","label":"deu","size":15,"recording_url":"https://cdn.media.ccc.de/events/god/2026/opus/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_opus.opus","url":"https://api.media.ccc.de/public/recordings/105410","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"video/mp4","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-24T16:37:24.035+02:00","label":"deu 576p","size":54,"recording_url":"https://cdn.media.ccc.de/events/god/2026/h264-sd/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_sd.mp4","url":"https://api.media.ccc.de/public/recordings/105411","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"video/webm;codecs=av01","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_av1-sd.webm","state":"new","folder":"av1-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-24T16:44:31.857+02:00","label":"deu 576p","size":40,"recording_url":"https://cdn.media.ccc.de/events/god/2026/av1-sd/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_av1-sd.webm","url":"https://api.media.ccc.de/public/recordings/105417","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"video/webm","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2026-09-24T16:48:32.178+02:00","label":"deu 576p","size":51,"recording_url":"https://cdn.media.ccc.de/events/god/2026/webm-sd/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/105419","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"video/webm","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-24T16:51:05.357+02:00","label":"deu 1080p","size":145,"recording_url":"https://cdn.media.ccc.de/events/god/2026/webm-hd/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/105420","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"},{"length":1519,"mime_type":"video/webm;codecs=av01","language":"deu","filename":"god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2026-09-24T16:55:04.638+02:00","label":"deu 1080p","size":118,"recording_url":"https://cdn.media.ccc.de/events/god/2026/av1-hd/god2026-110757-deu-How_to_Hack_Read-Only_SQL_MCP_Servers_Online_Fast_av1-hd.webm","url":"https://api.media.ccc.de/public/recordings/105421","event_url":"https://api.media.ccc.de/public/events/b5c2b975-b007-421a-bd58-d5a51ebbd5d5","conference_url":"https://api.media.ccc.de/public/conferences/god2026"}]}