I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have enough focus on keeping our applications safe.
Many times we need to react instead of proact when it comes to security, mainly because when a vulnerability is found it is not prioritized to be fixed because its unlikely to be exploited.
The following query is one of these examples. The server is running with PHP_MAGIC_QUOTES ON (yes I know thats really bad) and thus prevent exploits several places because the programmers have explicitly added ' ' around everyone input value used in queries (so you cant break out of it). The query I've found vulnerable now is however treated as an integer instead of string, and contains no ' ' around it.
Here is the example:
$sql = "select * from vulnerable_table where id = " . $_GET['id'] . " limit 1"; $result= mysql_query($sql);
How would you do max damage to the system considering you control the id variable.
Some examples I've come up with on my own:
id = 1;drop table mysql.user Only if semi colon is accepted id = 1;SELECT '<?php exec($_get['cmd'])?>' INTO OUT_FILE('/var/www/backdoor.php') Only if I could bypass the magic_quotes somehow