Is it possible to locate web document root using SQL query/SQL Injection?

Question

I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server.

Is it possible to somehow locate the root directory using a SQL query?

Answer 1

If you have permissions to write files, you probably have permission to read them, too.

I'd start from reading web server configuration files, e.g.

SELECT * LOAD_FILE('/etc/apache2/apache2.conf'); SELECT * LOAD_FILE('/etc/nginx/nginx.conf'); 

However, it's not guaranteed that the MySQL has permissions to write to the document root.