3

I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case with the strtoupper() PHP function as can be seen bellow:

$sql="select something from table order by ".strtoupper($injection);

The problem is that I can extract from information_schema and variable names but I can't extract data from other tables because the table name in the select query is defined in lowercase.

For example:

SELECT * FROM mysql.user   -- Will work.
SELECT * FROM MYSQL.USER   -- Cannot find MYSQL.USER.

Apparently, INFROMATION_SCHEMA is the same thing as information_schema. But this does not apply to the other tables as well.

To extract data I used the following injection: 

if(1=1,0,~0*2)

If the query returns true nothing happens, when is FALSE a generic message is revealed.

The MySQL server version is 5.7.19, the user is running as root but as I'v seen in the latest updates the server must be started with a special argument in order to use load_file or INTO OUTFILE statements.

I managed to sort of "bypass" the strtoupper() function by providing Cyrillic input characters but the MySQL does not recognize the table name because it's in Cyrillic.

Any advice on how to bypass this?

Improve this question
2

1 Answer 1

Reset to default
0

Use the sql CHAR() fonction for every character that needs to be lower case, put the whole request in a string using concat.

SET @T = CONCAT(CHAR(109),  CHAR(121),  [...]);
PREPARE A FROM @T;
EXECUTE A;
DEALLOCATE PREPARE A;

I tested it and it works well.

edit: showed the wrapping in proc

Improve this answer
4
  • 1
    Can you show the entire injection? Because afaik this will not work, as concat/char/lcase/etc will not work on table names (it didn't work with my setup; do you have some specific version you are using?).
    – tim
    Commented Sep 21, 2017 at 17:59
  • I was answering for the strtoupper() bypass, but there is some exec wrapping.Some people output a temporary script to a .sql file and then exec it back.
    – Nate
    Commented Sep 21, 2017 at 18:12
  • Chances are quite high that won't work, as almost everybody uses mysqli_query, PDO::query or similar which all doesn't allow multiple queries.
    – SleepProgger
    Commented Sep 22, 2017 at 15:42
  • Unfortunately, stacked queries are not working. With this in mind, I can neither define variables nor procedures or functions. And the database engine/plugin used is InnoDB so all tables are lowercased. I think I'm out of luck with this one and need to try another attack vector.
    – Sabin Nicula
    Commented Sep 22, 2017 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .