6

Take the following SQL query as an example:

UPDATE `sqlinjection2` SET `$vote`=`$vote`+1

Our goal is to increment the vote count by more than one, in one request.

We cannot access the code itself.

If we can send a value to $vote, we could send:

vote`=1, `vote`=X+`vote

So that the query looks like that:

SET `vote`=1, `vote`=X+`vote`=`vote`=1, `vote`=X+`vote`+1;

Clarification: X is a number.

My question is, how does this part work?

`vote`=X+`vote`=`vote`=1

I understand that it sets the column vote to be NULL, but why is that?

2

The example you give results in the value 0 (not NULL) being returned. This is because the query you constructed ended up to be a boolean comparison. The = within the assignment part(s) of an UPDATE statement is a comparison operator, not an assignment operator as you might expect.

Injection vote`=1, `vote`=10+`vote results in query UPDATE mytable SET /*part1*/`vote`=1, /*part2*/`vote`=10+`vote` = `vote`=1, /*part3*/`vote`=10+`vote` + 1 which deconstructs to this (using == as a comparison operator for clarity:

PART1:  
vote = 1

PART2: 
vote = ((10+vote) == vote) == 1
vote = ( 11 == vote ) == 1 
vote = ( 11 == 10 ) == 1 
vote = FALSE == 1
vote = FALSE (0) 

PART 3:
vote = 10 + vote + 1 
vote = 10 + FALSE (0) + 1 
vote = 11 

The more interesting injection would be to just set the vote column and then ending the query by using a comment:

$vote = "vote` = 1337 -- and we don't care about the rest";
// results in: 
// UPDATE mytable set `vote` = 1337 -- and we don't care about the rest` = `vote` = 1337 -- and we don't care about the rest` + 1

MySQL will ignore everything after the first occurance of -- as a comment and will set the value (actually, all vote values in the table) to 1337.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.