Operation systems had a confused deputy based privilege escalations for ages. But does it exist in a database? Usually the database security is only discussed in the context of protecting the database from the internet.
In the session I will demonstrate a number of cases where a simple select can be used to escalate privilege inside the database. I will also show a novel method of confusing some standard MySQL and PostgreSQL monitoring agents to retrieve private information (i.e. database passwords).