4

It turns out that I have an application that when I insert a simple quote the following appears to me:

httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: For input string: \"'\"","implementationDetails":"com.sun.jersey.api.ParamException$QueryParamException: java.lang.NumberFormatException: For input string: \"'\"\n\tat com.sun.jersey.server.impl.model.parameter.QueryParamInjectableProvider$QueryParamInjectable.getValue(QueryParamInjectableProvider.java:74)

The question I have is; can this parameter be used to perform SQL injection? If so, how can I test if this is the case?

Improve this question
2
  • Did you tried using sqlmap or something similar software?
    – OscarAkaElvis
    Commented Jul 6, 2017 at 22:29
  • No, I have not tried using any tools yet. For the message: "For input string" would you believe it is possible, or not?
    – user152754
    Commented Jul 6, 2017 at 22:33

2 Answers 2

Reset to default
2

Sure, it seems vulnerable. The backend is expecting a number there, and that generated the error. But the symptom of inserting a single quote and generating an error is a good signal, probably it is a SQL injection vulnerability.

The first step could be to know what kind of database is. I suppose you know that... because is your own database, right? :D

I recommend to you to launch some app like SQLMap to explore deeper the vulnerability.

Anyway, you can check the usual. There is an entire list of this. I'll put three of them:

' or '1'='1
a' or 1=1--
' or 0=0--
Improve this answer
4
  • I understand, Thank you very much, I was able to inject, thank you!
    – user152754
    Commented Jul 6, 2017 at 23:24
  • Glad to help. Mark as solved if was valid for you. Maybe could be useful for other users.
    – OscarAkaElvis
    Commented Jul 7, 2017 at 7:39
  • 2
    symptom of inserting a single quote and generate an error is 99% meaning of an sql injection vulnerability. hard to agree with that. Exception is being thrown by REST framework, which means there is validation mechanism before persistence layer.
    – user902383
    Commented Jul 7, 2017 at 8:51
  • Yeah, but it is alwasy a good signal. The proof it is the OP injected successfully as he said on his comment. Anyway I "moderated" my answer. Cheers.
    – OscarAkaElvis
    Commented Jul 7, 2017 at 13:43
0

NumberFormatException is usually an indication that the server performs a validation that an input is really a number. Providing a quote in this case obviously generates a input validation violation and this is not an indication of a potential SQL injection vulnerability. In order to confirm such a vulnerability you have to be able to tweak the result by providing inputs like

0 and 1=1 (=> lot of results because where clause always true)
0 and 1=0 (=> no results because where clause always false)

In your case I would presume these inputs will also only generate a NumberFormatException. So my guess is your code is not injectable.

Improve this answer
2
  • 1
    don't know why this should be down voted. Here is an link to the Specification of the NumberFormatException: docs.oracle.com/javase/7/docs/api/java/lang/… TL;DR If the given string is not an number (1,01(octal),0x1(hex)) then throw an Excepetion. I would not think that this could be exploitet and if its possible show it!
    – Serverfrog
    Commented Jul 7, 2017 at 8:37
  • I didn't downvote it, but I suspect the person did so because the OP reported that the SQL was indeed vulnerable to injection. It's certainly possible the flaw exploited a completely different field in the SQL.
    – John Deters
    Commented Jul 7, 2017 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .