3

It turns out that I have an application that when I insert a simple quote the following appears to me:

httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: For input string: \"'\"","implementationDetails":"com.sun.jersey.api.ParamException$QueryParamException: java.lang.NumberFormatException: For input string: \"'\"\n\tat com.sun.jersey.server.impl.model.parameter.QueryParamInjectableProvider$QueryParamInjectable.getValue(QueryParamInjectableProvider.java:74)

The question I have is; can this parameter be used to perform SQL injection? If so, how can I test if this is the case?

  • Did you tried using sqlmap or something similar software? – OscarAkaElvis Jul 6 '17 at 22:29
  • No, I have not tried using any tools yet. For the message: "For input string" would you believe it is possible, or not? – user152754 Jul 6 '17 at 22:33
2

Sure, it seems vulnerable. The backend is expecting there a number and that generated the error. But the symptom of inserting a single quote and generate an error is a good signal, probably it is a sql injection vulnerability.

The first step could be to know what kind of database is. It is supossed you know that... because is your own database, right? :D

I recommend to you to launch some app like sqlmap to explore deeper the vulnerability.

Anyway, you can check the usual. There is an entire list of this. I'll put three of them:

' or '1'='1
a' or 1=1--
' or 0=0--

Good luck.

  • I understand, Thank you very much, I was able to inject, thank you! – user152754 Jul 6 '17 at 23:24
  • Glad to help. Mark as solved if was valid for you. Maybe could be useful for other users. – OscarAkaElvis Jul 7 '17 at 7:39
  • 2
    symptom of inserting a single quote and generate an error is 99% meaning of an sql injection vulnerability. hard to agree with that. Exception is being thrown by REST framework, which means there is validation mechanism before persistence layer. – user902383 Jul 7 '17 at 8:51
  • Yeah, but it is alwasy a good signal. The proof it is the OP injected successfully as he said on his comment. Anyway I "moderated" my answer. Cheers. – OscarAkaElvis Jul 7 '17 at 13:43
0

NumberFormatException is usually an indication that the server performs a validation that an input is really a number. Providing a quote in this case obviously generates a input validation violation and this is not an indication of a potential SQLi vulnerability. In order to confirm such a vulnerability you have to be able to tweak the result by providing inputs like

0 and 1=1 (=> lot of results because where clause always true)
0 and 1=0 (=> no results because where clause always false)

In your case I would presume these inputs will also only generate a NumberFormatException. So my guess is your code is not injectable.

  • 1
    don't know why this should be down voted. Here is an link to the Specification of the NumberFormatException: docs.oracle.com/javase/7/docs/api/java/lang/… TL;DR If the given string is not an number (1,01(octal),0x1(hex)) then throw an Excepetion. I would not think that this could be exploitet and if its possible show it! – Serverfrog Jul 7 '17 at 8:37
  • I didn't downvote it, but I suspect the person did so because the OP reported that the SQL was indeed vulnerable to injection. It's certainly possible the flaw exploited a completely different field in the SQL. – John Deters Jul 7 '17 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.