How can Personal Access Tokens (PATs) be exploited in Confluence, and what SQL command is used?

Personal Access Tokens allow passwordless login to Confluence. If an attacker gains database access, they can modify the `HASHED_TOKEN` column in the `AO_81F455_PERSONAL_TOKEN` table to a known token hash, such as `{PKCS5S2}Deoq/psifhVO0VE8qhJ6prfgOltOdJkeRH4cIxac9NtoXVodRQJciR95GW37gR7/` (corresponding to token `MjE0NTg4NjQ3MTk2OrQ5JtSJgT/rrRBmCY4zu+N+NaWZ`), using an UPDATE SQL command. This method enables persistent unauthorized access and is covered in the database exploitation section of the [Confluence Usage Guide](/news/confluence-usage-guide).