Tagged Questions
5
votes
4answers
294 views
A customers site had a big mysql injection attack on it, just want to learn from it
I created an online store for a friend of mine.
I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The ...
-2
votes
0answers
65 views
SQL injection to a mysql database doesnt work [closed]
I am trying to execute the following query into a post query:
searchType=defaultSearch&name=&country="; //SQL INJECTION HERE ...
6
votes
3answers
512 views
Is there any SQL injection for this PHP login example?
I want to write a login form, and I got one example from the web.
I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like?
This is ...
6
votes
2answers
322 views
SQL Injection: Drop All Tables
I used some vulnerability scanners to check a site of mine, and an instance of blind SQL injection was returned. However, when I try to exploit this vulnerability by entering the following into the ...
1
vote
1answer
84 views
XSS MySQL Database Accessible?
I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page.
I have the following link. When you go to this link, the text I've enclosed ...
-2
votes
1answer
375 views
Admin area in my php website is vulnerable to sql injection without login [closed]
my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel.
...
5
votes
1answer
286 views
My site just got hit with a SQL injection attack, how can I tell what they were doing?
So a page on my site (it's a PHP page that displays newsletter articles) was vulnerable to SQL injection and got hit. I discovered it because it was doing enough database queries to cause the CPU load ...
2
votes
1answer
221 views
SQL injecting a search form which uses boolean mode
I'm testing a web app and I could get Mysql errors by inserting ' in the search field:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the ...
0
votes
1answer
309 views
sql injection: use WHERE statement in address bar
How can i use "Where" statement during an sql-injection attack in address bar ?
for example:
... from+information_schema.TABLES+where+TABLE_SCHEMA+=+XXXX--
The code above does not work.
2
votes
1answer
228 views
Using mysql root account to execute root commands
Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
7
votes
3answers
551 views
Should IP addresses be validated to prevent SQL Injection?
In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses.
Should I validate user IP addresses before using ...
1
vote
2answers
268 views
Strange Pharma Spam Site resulting from DAT file created by SQL Injection?
Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
5
votes
2answers
633 views
Could this login form be “hacked” to allow access?
We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell:
$email=$_POST['email'];
...
3
votes
4answers
2k views
How is my website vulnerable for sql injections?
I am running a small website where I have published some articles.
I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
11
votes
2answers
2k views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
16
votes
7answers
821 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
