2

I am using the vulnerable web app mutillidae.

There is a webpage where you can view information from a profile but you first need to provide a user and a password. Once you click send, it sends it to a mysql database with this URL:

http//192.168.x.x/mutillidae/index.php
 ?page=user-info.php&username=the_userd&password=the_pass&user-info-php-submit-button=View+Account+Details

I know the table is accounts and the columns are: cid, username, password, mysignature, is_admin.

This screenshot shows the table accounts: https://imgur.com/9F9aHbS

I wish to be able to add a new user to the database (table accounts)

I tried with these URLs:

http//192.168.x.x/mutillidae/index.php
 ?page=user-info.php&username=d"union insert into accounts ("cid","username","password","mysignature","is_admin") values ("18","bob1", "bob1","mysign","FALSE");--&password=d&user-info-php-submit-button=View+Account+Details 

http//192.168.x.x/mutillidae/index.php
 ?page=user-info.php&username=d";insert into accounts ("cid","username","password","mysignature","is_admin") values (18,"bob1", "bob1","mysign",FALSE);--&password=d&user-info-php-submit-button=View+Account+Details

If it can help, here is the pastebin of the vulnerable page (php source code): http://pastebin.com/wfnL68jw with a sample:

            //Accept data from either GET or POST to make this target soft for SQLMAP
            $lUsername = $_REQUEST["username"];
            $lPassword = $_REQUEST["password"];

            $LogHandler->writeToLog($conn, "Recieved request to display user information for: " . $lUsername);

            $lQuery  = "SELECT * FROM accounts WHERE username='".
            $lUsername .
            "' AND password='" .
            $lPassword .
            "'";
            $lEncodeOutput = FALSE;
  • what's your question? – schroeder Mar 19 '16 at 20:18
  • @schroeder updated the question, I wish to add a new user to the database. (with insert if possible) – Bob Ebert Mar 19 '16 at 20:21
  • If you are sure this script is vulnerable: You might need to fiddle a bit with the encoding of your injection string. Does your HTTP client maybe auto-encode them differently that what you except them to be? Could you include the relevant part of the code of the service in your question so it is self containing and can be helpful for others, later on? This would also help make it easier for us to see what is happening. – Tobi Nary Mar 19 '16 at 21:42
  • @SmokeDispenser I am sure it is vulnerable (it's meant to be and I was able to use the union select statement). I updated a link with the code of the page in the question. Thanks for the comment. – Bob Ebert Mar 19 '16 at 22:52
  • Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. – Tobi Nary Mar 19 '16 at 23:02
1

I'm assuming that you would like to figure out the exact method yourself and are only looking to be pointed in the right direction.

PHP database query methods typically only allow a single query per call. So you have to make an injection that is part of the one query that is executed.

However, I'm pretty sure you can't INSERT data using injection, only manipulate the outcome of a SELECT.

  • if it is a login page (thus using INSERT), couldn't I craft an INSERT query to make a new account (admin)? – Bob Ebert Mar 22 '16 at 13:11
  • As far as I'm aware, you can not create a nested insert. You could however, manipulate the original INSERT statement. – Jacco Mar 22 '16 at 13:18
  • You seems right, even in this answer, he is saying the same thing security.stackexchange.com/questions/33900/…. Although, UNION allow you to create a new request that is executed. What about that? it says here that UNION only allow SELECT sqlinjection.net/stacked-queries – Bob Ebert Mar 22 '16 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.