Academic Journal
SQLaser: Detecting database management system (DBMS) logic bugs with clause-guided fuzzing.
| Title: | SQLaser: Detecting database management system (DBMS) logic bugs with clause-guided fuzzing. |
|---|---|
| Authors: | Wei, Jin, Chen, Ping, Lu, Kangjie, Dai, Jun, Sun, Xiaoyan |
| Source: | Journal of Computer Security; Jan2026, Vol. 34 Issue 1, p3-28, 26p |
| Subject Terms: | Database management, Databases, Logical fallacies, Relational databases, Defect tracking (Computer software development), Computer software testing |
| Abstract: | Database management systems (DBMSs) are vital components in modern data-driven systems. Their complexity often leads to logic bugs, which are implementation errors within the DBMSs that can lead to incorrect query results, data exposure, unauthorized access, etc., without necessarily causing visible system failures. Existing detection employs two strategies: rule-based bug detection and coverage-guided fuzzing. In general, rule specification itself is challenging; as a result, rule-based detection is limited to specific and simple rules. Coverage-guided fuzzing blindly explores code paths or blocks, many of which are unlikely to contain logic bugs; therefore, this strategy is cost-ineffective. In this paper, we design SQLaser, a SQL-clause-guided fuzzer for detecting logic bugs in DBMSs. Through a comprehensive examination of existing logic bugs across four distinct DBMSs, excluding those causing system crashes, we have identified 35 logic-bug patterns. These patterns manifest as certain SQL clause combinations that commonly result in logic bugs, and behind these clause combinations are a sequence of functions. We therefore model logic-bug patterns as error-prone function chains (i.e., sequences of functions). We further develop a directed fuzzer with a new path-to-path distance-calculation mechanism for effectively testing these chains and discovering additional logic bugs. This mechanism enables SQLaser to swiftly navigate to target sites and uncover potential bugs emerging from these paths. Our evaluation, conducted on SQLite, MySQL, PostgreSQL, and TiDB, demonstrates that SQLaser significantly accelerates bug discovery compared to other fuzzing approaches, reducing detection time by approximately 60%. As a standalone fuzzer, SQLaser identified 22 bugs spanning 18 of the 35 logic-bug patterns, outperforming contemporary fuzzers such as SQLRight, which only uncovered two logic bugs across two patterns within the same testing period (i.e., 60 days) when testing SQLite. Notably, four of the bugs discovered by SQLaser are zero-day, all of which have been reported to and confirmed by vendors. [ABSTRACT FROM AUTHOR] |
| Copyright of Journal of Computer Security is the property of Sage Publications Inc. and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Complementary Index |
| FullText | Text: Availability: 0 |
|---|---|
| Header | DbId: edb DbLabel: Complementary Index An: 189916261 RelevancyScore: 1041 AccessLevel: 6 PubType: Academic Journal PubTypeId: academicJournal PreciseRelevancyScore: 1041.06604003906 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: SQLaser: Detecting database management system (DBMS) logic bugs with clause-guided fuzzing. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Wei%2C+Jin%22">Wei, Jin</searchLink><br /><searchLink fieldCode="AR" term="%22Chen%2C+Ping%22">Chen, Ping</searchLink><br /><searchLink fieldCode="AR" term="%22Lu%2C+Kangjie%22">Lu, Kangjie</searchLink><br /><searchLink fieldCode="AR" term="%22Dai%2C+Jun%22">Dai, Jun</searchLink><br /><searchLink fieldCode="AR" term="%22Sun%2C+Xiaoyan%22">Sun, Xiaoyan</searchLink> – Name: TitleSource Label: Source Group: Src Data: Journal of Computer Security; Jan2026, Vol. 34 Issue 1, p3-28, 26p – Name: Subject Label: Subject Terms Group: Su Data: <searchLink fieldCode="DE" term="%22Database+management%22">Database management</searchLink><br /><searchLink fieldCode="DE" term="%22Databases%22">Databases</searchLink><br /><searchLink fieldCode="DE" term="%22Logical+fallacies%22">Logical fallacies</searchLink><br /><searchLink fieldCode="DE" term="%22Relational+databases%22">Relational databases</searchLink><br /><searchLink fieldCode="DE" term="%22Defect+tracking+%28Computer+software+development%29%22">Defect tracking (Computer software development)</searchLink><br /><searchLink fieldCode="DE" term="%22Computer+software+testing%22">Computer software testing</searchLink> – Name: Abstract Label: Abstract Group: Ab Data: Database management systems (DBMSs) are vital components in modern data-driven systems. Their complexity often leads to logic bugs, which are implementation errors within the DBMSs that can lead to incorrect query results, data exposure, unauthorized access, etc., without necessarily causing visible system failures. Existing detection employs two strategies: rule-based bug detection and coverage-guided fuzzing. In general, rule specification itself is challenging; as a result, rule-based detection is limited to specific and simple rules. Coverage-guided fuzzing blindly explores code paths or blocks, many of which are unlikely to contain logic bugs; therefore, this strategy is cost-ineffective. In this paper, we design SQLaser, a SQL-clause-guided fuzzer for detecting logic bugs in DBMSs. Through a comprehensive examination of existing logic bugs across four distinct DBMSs, excluding those causing system crashes, we have identified 35 logic-bug patterns. These patterns manifest as certain SQL clause combinations that commonly result in logic bugs, and behind these clause combinations are a sequence of functions. We therefore model logic-bug patterns as error-prone function chains (i.e., sequences of functions). We further develop a directed fuzzer with a new path-to-path distance-calculation mechanism for effectively testing these chains and discovering additional logic bugs. This mechanism enables SQLaser to swiftly navigate to target sites and uncover potential bugs emerging from these paths. Our evaluation, conducted on SQLite, MySQL, PostgreSQL, and TiDB, demonstrates that SQLaser significantly accelerates bug discovery compared to other fuzzing approaches, reducing detection time by approximately 60%. As a standalone fuzzer, SQLaser identified 22 bugs spanning 18 of the 35 logic-bug patterns, outperforming contemporary fuzzers such as SQLRight, which only uncovered two logic bugs across two patterns within the same testing period (i.e., 60 days) when testing SQLite. Notably, four of the bugs discovered by SQLaser are zero-day, all of which have been reported to and confirmed by vendors. [ABSTRACT FROM AUTHOR] – Name: Abstract Label: Group: Ab Data: <i>Copyright of Journal of Computer Security is the property of Sage Publications Inc. and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=edb&AN=189916261 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.1177/0926227X251370258 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 26 StartPage: 3 Subjects: – SubjectFull: Database management Type: general – SubjectFull: Databases Type: general – SubjectFull: Logical fallacies Type: general – SubjectFull: Relational databases Type: general – SubjectFull: Defect tracking (Computer software development) Type: general – SubjectFull: Computer software testing Type: general Titles: – TitleFull: SQLaser: Detecting database management system (DBMS) logic bugs with clause-guided fuzzing. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Wei, Jin – PersonEntity: Name: NameFull: Chen, Ping – PersonEntity: Name: NameFull: Lu, Kangjie – PersonEntity: Name: NameFull: Dai, Jun – PersonEntity: Name: NameFull: Sun, Xiaoyan IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 01 Text: Jan2026 Type: published Y: 2026 Identifiers: – Type: issn-print Value: 0926227X Numbering: – Type: volume Value: 34 – Type: issue Value: 1 Titles: – TitleFull: Journal of Computer Security Type: main |
| ResultId | 1 |