Beacon: Detecting Broken Access Control Vulnerabilities in DBMSs via System Catalog Consistency Validation
Read the paper · doi:10.1145/3798232
What this paper does with SQLancer
Cited in the design discussion as the logic-bug testing line of work, with NoREC and TLP described by what each compares -- the correctness dimension Beacon sets beside its own access-control one.
Beacon detects broken access control vulnerabilities in DBMSs by checking SQL operations against the system catalogs. Its premise is that catalog visibility should agree with a user's privileges: if an object is invisible to a user in the catalogs, that user should have no access to it, so any inconsistency indicates a privilege they should not have. Applied to eight DBMSs it uncovered 39 previously unknown vulnerabilities, all confirmed by vendors.
How it was classified
uses infrastructure — no
SQLancer is cited, not used; nothing in the mentions describes reusing its code.
extends technique — no
No technique is extended; the citation is background.
compares with — no
No empirical comparison against SQLancer is reported in the mentions.
describes as state of the art — no
The citation does not characterise SQLancer as the state of the art.
SQLancer publications it cites (5)
Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.
| # | Entry | Matched as |
|---|---|---|
| 2 | Jinsheng Ba and Manuel Rigger. 2024. Cert: Finding performance issues in database systems through the lens of cardinality estimation. InProceedings of the IEEE/ACM 46th International Conference on Software Engineering... | sqlancer publication · CERT |
| 17 | Jingzhou Fu, Jie Liang, Zhiyong Wu, Yanyang Zhao, Shanshan Li, and Yu Jiang. 2025. Understanding and Detecting SQL Function Bugs: Using Simple Boundary Arguments to Trigger Hundreds of DBMS Bugs. InProceedings of the ... | project authored |
| 42 | OceanBase. 2025. CREATE TRIGGER. https://en .oceanbase .com/docs/common-oceanbase-database10000000001974512. Accessed: Feb. 27, 2026. | project authored |
| 70 | Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. InProceedings of the 28th ACM Joint Meeting on European Software Engineering Confe... | sqlancer publication · NOREC |
| 71 | Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning.Proceedings of the ACM on Programming Languages4, OOPSLA (2020), 1–30. doi:10.1145/3428279 | sqlancer publication · TLP |
Every place it refers to SQLancer (6)
6 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.
| Id | Sentence | Found by | Where |
|---|---|---|---|
| M1 | Specifically, the user creates a trigger [ 42] containing SELECT operations that require the privileges of another user’s table. |
citation marker project authored |
1 Introduction page 2 |
| M2 | Another test case generation approach for detecting consistency issues is mutation-based testing, which has been widely used in compiler testing and optimization testing [ 26,70,71,81]. |
citation marker |
6.4 Design Choice Analysis page 23 |
| M3 | Logic bug testing [ 10,15,18,25,28,70,71] focuses on verifying the correctness of execution results. |
citation marker |
6.4 Design Choice Analysis page 24 |
| M4 | For example,NoREC[ 70] detects differences in result sets between optimizing and non-optimizing query versions, and TLP[ 71] detects whether composed results of partitioning queries are equivalent to the original query’s results. |
technique |
6.4 Design Choice Analysis page 24 |
| M5 | Crash bug testing [ 16,17,27,74,82,93,95] aims to identify circumstances under which DBMSs might crash. | citation marker project authored | 6.4 Design Choice Analysis page 24 |
| M6 | Performance bug testing [ 2,24,29,91,92] checks whether execution results are returned within reasonable time limits. | citation marker | 6.4 Design Choice Analysis page 24 |