2

I have a parameter (pi_apk_version_code) that seems to be vulnerable to SQL Injection (the team is divided on this). The database column corresponding to this parameter accepts only numeric values. Now, if a payload "; or 1=1" is manually given as input to this parameter, the output is an Oracle error code (ORA-01722: invalid number). The same input when given via a fuzzer does not result in an Oracle error code, but returns the desired results from the query.

  1. Is this indicative of SQL injection being present?
  2. If you think SQL injection is present, what are some payloads you will supply to exploit it so that one can be convinced that SQL injection is really present?

[Edit]

SQLmap was run for this and no issues were detected.

[Edit]

PL/SQL Queries in focus (pi_apk_OS and pi_apk_version_code are inputs coming from the client):

    SELECT COUNT(1)
          INTO l_count
          FROM APK_VERSION_MASTER
         WHERE apk_OS = pi_apk_OS
              --AND  apk_version_code = pi_apk_version_code
           AND Status = 'A';
     

        OPEN rc_result FOR
          SELECT apk_version_code,
                 apk_version_string,
                 (CASE
                   --WHEN pi_apk_version_code < apk_version_code THEN
                   WHEN pi_apk_version_code < lowest_version_code THEN 
                    'Y'
                   ELSE
                    'N'
                 END) AS is_Mandatory,
                 path,
                 upgrade_playstore,
                 l_error_code return_code,
                 l_error_message return_message
            FROM APK_VERSION_MASTER
           WHERE apk_OS = pi_apk_OS
             AND apk_version_code = (SELECT MAX(apk_version_code)
                                       FROM APK_VERSION_MASTER b
                                      WHERE b.apk_OS = pi_apk_OS
                                        AND Status = 'A');
  • Can you clarify whether this is a parameterized query? – JimmyJames May 10 '16 at 13:33
  • @JimmyJames These are not parameterized queries. I have edited the question and pasted the sample queries. These are PL/SQL queries inside a function that is being called by a Java code. – Earthling May 10 '16 at 13:48
  • Sorry, but to be clear, this SQL is being concatenated together and then run on the server? I'm still fuzzy on how the inputs are applied to the SQL. – JimmyJames May 10 '16 at 14:10
  • Both are separate and independent SQL statements. The parameters come into the function from the client and is used without any validation. – Earthling May 10 '16 at 14:15
  • It's the 'come into the function' part that I am not totally clear on. You've got the input from the client. How does it get into the SQL statement? Is it simple string concatenation (+ or StringBuilder) or something else? I'm really not trying to be a pest here, just don't want to make any assumptions. – JimmyJames May 10 '16 at 14:21
1

It depends on the code of your application whether this input can be misused, not on the database or the query (disregarding parametrized queries).

If your application rejects all but valid numbers, there is no possibility that the input can be misused, since only "harmless" numbers will be inserted into the query.

If your application does no proper validation and inserts the input directly to the SQL statement, SQL-injection may be possible. You didn't include your query so i will invent an example. Following query should list all articles of a given category:

SELECT name FROM articles WHERE category = 1

Instead of 1 our input is 1 UNION...

SELECT name FROM articles WHERE category = 1 UNION SELECT password FROM users

This would return a much larger list...

  • Nice union ... :) – Mxsky May 11 '16 at 6:28
  • Does 1e999 count as a valid number? Many languages sure think so... – Luc Nov 20 '17 at 12:34
  • @Luc - Of course this depends on your validation function, most languages offer a function to convert a string to an int and this function usually accepts exponent notation. Most frameworks offer validation functions which are configurable, so you can choose what you accept and what not (negative numbers, exponents, thousand separators). Whenever the environment does not offer such validation functions, I would recommend to write a set of such functions yourself, it's not difficult to do. – martinstoeckli Nov 20 '17 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.