3

I am trying penetration testing for one of my clients. The platform is Code ignitor. There is an endpoint /find/1. The function queries from the vehicle table where vehicle ID is 1 with no sanity check.

Now I tried Acunetix (scanner) and it found both a blind SQL and normal SQL injection vulnerability on the website. I need to show my client there is actually a flaw, so I used sqlmap with various options.

Like I know the backend DB is mysql, —skip-WAF and marked /find/1* with the asterisk marking the injection point.

Sqlmap performed detail evaluation, however couldn’t exploit the vulnerability. I scanned with a higher risk setting (--risk) and verbose to see the queries myself as well.

What I noticed is that * is marked as non-permitted character in the config of code ignitor which prevents sqlmap from making SELECT * FROM [...] etc. queries.

Shall I assume that the website is safe? Since I can see that in the code the sanity check has not been performed on the “input data”.

Improve this question
2
  • Not every flaw is exploitable. But the asterisk can be urlencoded as %2A so I would perhaps try that or add some whitespace. Maybe use a fuzzer to generate more combinations than SQLmap would. Many applications perform validation with regular expressions, but a common flaw is that the regular expression does not expect multiline input, thus you can still inject malicious content.
    – Kate
    Commented Mar 31, 2020 at 19:54
  • Thanks.. do you know which tamper to use for * in sqlmap?
    – Badddy
    Commented Mar 31, 2020 at 20:04

1 Answer 1

Reset to default
1

It depends on what you mean by "no sanity check" is performed on the input parameter. If this means that the application takes the parameter, concatenates it into a SQL query and sends it to the database, the application is vulnerable for sure. Only blocking * is not enough to protect against SQL injection.

Never assume the site is safe, if you have doubts about it! Even if you are not able to create a working exploit, you should recommend implementing database queries using prepared statements (or similar mechanisms). It is considered best practice and there is usually no reason not to use them.

Improve this answer
6
  • Yes jt concatenates with query and send to DB. However I meed to show PoC to my client for recommendations
    – Badddy
    Commented Mar 31, 2020 at 16:31
  • Creating a PoC should be easy, if you have access to the source code. Just create a query that proves that SQL syntax is executed. I cannot offer anything generic without the source and without a test system to try things out. If you have permission to do so, you can post the relevant part of the source code here and the community can have a look.
    – Demento
    Commented Mar 31, 2020 at 16:35
  • Can you suggest any appended query based on the query i mentioned above that does shows sql injection exist or any way to tamper * in sqlmap please
    – Badddy
    Commented Mar 31, 2020 at 16:39
  • Without the source code it is just guessing, but if a query like "1 and 1=1-- x" executes and returns the vehicle with ID 1, you can be pretty sure that the SQL injection works. If it doesn't work, this means nothing! There is no generic PoC and you must adapt the PoC to the application. If my example works and you want to be really sure, send "1 and 1=2-- x" and see if it works again. If it works with the first but not with the second sequence, you can be pretty sure that's an SQL injection.
    – Demento
    Commented Mar 31, 2020 at 16:53
  • When I tried first one. The app throws an error with the query .. Select * From vehicle where (title Like ‘%1’1%20and%201=1 OR engine_no Like <same as with title) order by id desx
    – Badddy
    Commented Mar 31, 2020 at 19:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .