sql injection, count() as

Question

i'm trying to improve my skills and understanding of sql injection and defence from it.

the query takes two forms depending on what i'm trying to pass:

1)

    SQL Error: The used SELECT statements have a different number of columns at /home/xxxxxxxx/www/system/models/additional_user_news.class.php line 215
Array
(
    [code] => 1222
    [message] => The used SELECT statements have a different number of columns
    [query] => SELECT * FROM cms_news WHERE node_id=45 AND topic_id = 18 AND active='1'  AND title LIKE '%' union select 1 # %' ORDER BY sort DESC, dateCreated DESC LIMIT 0,10
    [context] => /home/xxxxxxxx/www/system/models/additional_user_news.class.php line 215
)

in the case i'm trying to pass ' union select 1 #

2)

SQL Error: The used SELECT statements have a different number of columns at /home/xxxxxxxx/www/system/models/additional_user_news.class.php line 197
Array
(
    [code] => 1222
    [message] => The used SELECT statements have a different number of columns
    [query] => SELECT COUNT(id) as cnews FROM cms_news WHERE node_id = 45  AND topic_id=18 AND active='1' AND dateCreated<=1475703392
                  AND title LIKE '%' union select 1,2 #%'  
                  LIMIT 0,1
    [context] => /home/xxxxxxxx/www/system/models/additional_user_news.class.php line 197

)

if i'm trying to pass something like this: ' union select 1,2 #

I simpely don't understand why it gives me 2 different queries for different search tags. And how is it possible in this way to find right number of columns?

Answer 1

You are injecting into two different queries, which have different column counts.

The first query at line 197 selects one column, so ' union select 1 # works without breaking the query. The second query at line 215 however selects a different number of columns, and thus it breaks.

You can still perform an SQL injection though:

• Error based: Error based injection into the first query will work, as you are shown errors.
• Blind: If errors would not be shown, you could still perform a timing-based blind injection into the first query (depending on the exact code, it may also work content-based).

Answer 2

If you see the first line in your examples you see that the line numbers are different. The code is first counting how many news items are creating after a set date, then getting the actual data. So it seems like the site is protected against this particular attack by using inefficient queries, since the two queries are returning different number of columns