How we can update a table via sqlmap ? The injection is like this :


I've a mysql User with this privileges and roles :

[*] 'testUser'@'localhost' [17]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: SELECT
    privilege: SHOW VIEW
    privilege: TRIGGER
    privilege: UPDATE

[*] 'testUser'@'localhost' [17]:
        role: ALTER
        role: ALTER ROUTINE
        role: CREATE
        role: CREATE ROUTINE
        role: CREATE VIEW
        role: DELETE
        role: DROP
        role: EVENT
        role: EXECUTE
        role: FILE
        role: INDEX
        role: INSERT
        role: SELECT
        role: SHOW VIEW
        role: TRIGGER
        role: UPDATE

but it's just return none as result !

UPDATE SMS SET Message='This is for Test' WHERE ClientID='42';: None

The Select statement works well but I just wondering is there any chance to update via sqlmap ?

  • Just having the privilege granted doesn’t mean you can utilize it via SQL injection. Sometimes you are restricted to the current SQL statement as the driver doesn’t allow the execution of multiple statements at once.
    – Gumbo
    Commented Oct 10, 2015 at 13:24
  • Can you please Show us how the Injektion Looks like.
    – davidb
    Commented Oct 10, 2015 at 14:16

1 Answer 1


This is simply not possible. The reason for that is that the MySQL module of PHP does not allow one to append complete queries. So this won't work:

http://victim.com/index.php?id=1'; UPDATE anytable SET anyattribute='anyvalue' --

You also can't use UNION to append a UPDATE, DELETE or INSERT Query because it only allows one to join SELECT statements.

You can UPDATE a MySQL database through an SQL Injection only if the original query is a UPDATE query. And also this is much more limited than SQL Injections in SELECT statements to extract data.

But there is another way you might be able to alter data. In your injection you use the load_file function. If this function works you can use it to read the content of the .php files searching for the mysql_connect method which will contain the credentials for the databse. You can then with these credentials connect to the database under some conditions and query the database directly.

And finally: I strongly suggest you not to use tools like sqlmap till the moment you are able to exploit SQL Injections blindfolded and with one hand tied to your back because you don't learn much just using sqlmap.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .