OWASP Global AppSec Lisbon 2024

In the context of relational databases such as Postgres, MySQL/MariaDB or MSSQL, a transaction is a construct used to wrap complex business operations, ensuring the application is safe from data corruption. But what happens when they start working against you?


This presentation will show a darker side of database transactions: as a potential source of application vulnerabilities. Learn how common patterns of (mis)use can introduce data races and easily exploitable race conditions. We’ll dig into database internals and find out how the helpful hand of the database engine introduces the vulnerability, ways of exploiting it and look at possible mitigations.