I am exploring a vulnerability in one PHP website that is basically riddled with SQL injections. With SQLMap, I managed to dump all the tables and get some basic information (username, DB name, hostname, though the it seems pretty useless because the DB server is not externally available). My goal is to modify data in a specific table, not mentioned in any injectable SQL queries. I tried SQLmap's
--db-shell switch, but I found out I cannot do anything beyond SELECT because PHP+MySQL combination disallows stacked queries.
Thus my question. Given one of the following snippets:
mysql_query("SELECT * FROM sometable WHERE id=".$_GET['id']); mysql_query("INSERT INTO sometable (id) VALUES (".$_GET['id'].")"); mysql_query("UPDATE sometable SET id= ".$_GET['id']); mysql_query("DELETE FROM sometable WHERE id=".$_GET['id']);
Can I modify (delete, insert, update) data from outside of sometable, without LOADFILE/INTO OUTFILE (and similar) tricks? Would MySQL syntax let me do it in this case? If the answer is "depends", how would the query syntax look like to let me through? I am not a DBA on this host. There are also no stored procedures on the website, just some very basic, amateur stuff that you could learn from a single book that doesn't even mention security.