SQL injection possible with hidden GET parameters?

Question

I was asked by my friend to play around with his family's new website and report any bugs I may encounter. Going through the pages, I noticed one that very much looks like it's prone to SQL injection. I do not have access to the source code as it is hosted by a local website design company.

http://website.tld/product/1234/a-beautiful-vase

After playing around with the URL, I was able to get the exact same page with:

http://website.tld/product.php/id=1234

I replaced 1234 with 1234' and the website threw the following error:

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/shop/public_html/product.php on line 34

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/shop/public_html/product.php on line 40

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1234''' at line 1

I also tried replacing id=1234 with id=1234 AND 1=1 (automatically encoded by the browser into id=1234%20AND%201=1) and id=1234 AND 1=2 (automatically encoded by the browser into id=1234%20AND%201=2). With both attempts, the web page succeeds to load the product page with two additional errors thrown:

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/shop/public_html/product.php on line 205

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/shop/public_html/product.php on line 217

The product page looks normal with the product information, weight, price, and image all correctly populated. There is no SQL syntax error. And that's where I got a little confused.

I also tried a bunch of other variations:

• id='1234%20AND%201=2 yielded ...to use near '1234%20AND%201'' at line 1
• id=1234'%20AND%201=2 yielded ...to use near ''' at line 1
• id='1234'%20AND%201=2 yielded ...to use near '1234'%20AND%201'' at line 1
• id=1234%20AND%20'1'=2 yielded ...to use near '1''' at line 1

However, id=1234%20AND%201='2 also renders the correct product page with the two PHP warnings same as above:

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/shop/public_html/product.php on line 205

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in /home/shop/public_html/product.php on line 217

I guess my questions are:

1. Is it possible, in this case, to perform SQL injection? I found extensive tutorials online explaining how to inject normal GET parameters. However, if I'm not much mistaken, .htaccess is used to rewrite the URL so would that prevent (or change) the procedure?
2. Secondly, since the browser encodes special characters (for example spaces to %20), doesn't that mean MySQL will get something like WHERE id='1234%20AND%201=1 and cause a syntax error?
3. Why did it yield the same result even when I tried adding AND 1=1 and AND 1=2 at the end of the id parameter?
4. Why did id=1234%20AND%20'1'=2 yield ...to use near '1''' at line 1? I only put one single quote around 1 yet the error seems to indicate there are two additional single quotes after 1?
5. The web browser (I'm using Google Chrome) doesn't seem to encode the = sign, yet manually changing it into %3D doesn't seem to make a difference in the outcome. Why is that?

Two additional points I'd like to point out:

• The PHP warnings thrown when there is an SQL syntax error and when there isn't are different, simply take a look at the line numbers. I'm guessing line 205 and 217 are queries used to find related products whereas the main query pulling up the id=1234 product is located around line 34-40.
• id=1234%20-- renders the product page perfect with no error or warning at all.

Answer 1

I'll try to answer one question at at time,

1. Is it possible, in this case, to perform SQL injection? I found extensive tutorials online explaining how to inject normal GET parameters. However, if I'm not much mistaken, .htaccess is used to rewrite the URL so would that prevent (or change) the procedure?

Yes, it is possible. Since the query is expecting to return one result, you can force the current query to return no results (check point 3) and then make a union with another table (for example the users table) and return a single row at a time.

2. Secondly, since the browser encodes special characters (for example spaces to %20), doesn't that mean MySQL will get something like WHERE id='1234%20AND%201=1 and cause a syntax error?

No, the characters are only encoded in the url, when the String reaches the server it will be as if it wasn't encoded.

3. Why did it yield the same result even when I tried adding AND 1=1 and AND 1=2 at the end of the id parameter?

You're getting that error because the query is returning false, maybe because the way the query is constructed and you're not injecting on it right. For example when you say AND 1=2 you're making the condition false and no rows are returned. But better read this to understand better.

Try to put -- after, like id=1234 OR 1=1 --, to try to avoid that error.

4. Why did id=1234%20AND%20'1'=2 yield ...to use near '1''' at line 1? I only put one single quote around 1 yet the error seems to indicate there are two additional single quotes after 1?

It may be the format for the database to return the errors, if you notice, in the other errors, it is adding '' in the end also.

5. The web browser (I'm using Google Chrome) doesn't seem to encode the = sign, yet manually changing it into %3D doesn't seem to make a difference in the outcome. Why is that?

Look at point 2. When the String reaches the server it will be a = in any case.