Could this login form be “hacked” to allow access?

Question

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell:

$email=$_POST['email'];
$password = $_POST['password'];

$query = "SELECT aes_decrypt(password, 'asdasdasd') AS password FROM users WHERE email='$email'";
$result = mysql_query($query);
$row = mysql_fetch_array($result);

if($password == $row['password']){
    // set cookies and redirect user etc etc
}
else {
    // error not correct login details
}

My question is, I realise that this is bad because of SQL injection. And I know the basics of that. i.e. You could put '; DROP ALL TABLES; -- and that would "cause havoc".

Can anything more "interesting" or "useful" (to the potential hacker) be done? I.e., can you output a list of passwords, or download the tables with this? Or could you manage to log yourself in as a user of the site, for instance if you only know their email address?

Mainly for interest, but also for better insight (and therein finding better approaches to coding).

Answer 1

Well, with this, you can easily login with just the email, here's why :

The default query is :

SELECT aes_decrypt(password, 'asdasdasd') AS password FROM users WHERE email='$email';

Which mean, if :

$email = "bob@gmail.com";
SELECT aes_decrypt(password, 'asdasdasd') AS password FROM users WHERE email='bob@gmail.com';

Now, If I do this instead :

$email = "dontcare' UNION SELECT "mypass" AS password FROM users WHERE email='bob@gmail.com' LIMIT 1, 1";
$pass = "mypass";
SELECT aes_decrypt(password, 'asdasdasd') AS password FROM users WHERE email='dontcare'; SELECT "mypass" AS password FROM users WHERE email='bob@gmail.com';

Your code will receive the second query, get the password that will match "mypass", return true, so will auth me for the bob@gmail.com account.

Now, with "just" the code you showed us, an attacker can't display a whole table, but since the author of the code didn't take care of securing user input, I'd say that if it's not in that piece of code, there is a high probability that it's still possible some place else.

Answer 2

cx42net's answer is wrong. The mysql_query() function only processes a single MySQL statement so in order to carry out an SQL injection you'd need to use a UNION.

The real WTF here is that if the query returns no rows and the password is blank then the user is authenticated as whatever user they presented!