A rogue MySQL server could be used to steal files from clients due to a design flaw in the popular an open source relational database management system (RDBMS).
The flaw resides in the file transfer process between a client host and a MySQL server, it could be exploited by an attacker running a rogue MySQL server to access any data that could be read by the client.
The issue ties with the LOAD DATA statement used with the LOCAL modifier. The LOAD DATA statement can load a file located on the server, and if the LOCAL keyword is used in the request, on the client host.
