1

I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case with the strtoupper() PHP function as can be seen bellow:

$sql="select something from table order by ".strtoupper($injection);

The problem is that I can extract from information_schema and variable names but I can't extract data from other tables because the table name in the select query is defined in lowercase.

For example:

SELECT * FROM mysql.user   -- Will work.
SELECT * FROM MYSQL.USER   -- Cannot find MYSQL.USER.

Apparently, INFROMATION_SCHEMA is the same thing as information_schema. But this does not apply to the other tables as well.

To extract data I used the following injection:

if(1=1,0,~0*2) 

If the query returns true nothing happens, when is FALSE a generic message is revealed.

The MySQL server version is 5.7.19, the user is running as root but as I'v seen in the latest updates the server must be started with a special argument in order to use load_file or INTO OUTFILE statements.

I managed to sort of "bypass" the strtoupper() function by providing Cyrillic input characters but the MySQL does not recognize the table name because it's in Cyrillic.

Any advice on how to bypass this?

1

Use the sql CHAR() fonction for every character that needs to be lower case, put the whole request in a string using concat.

SET @T = CONCAT(CHAR(109),  CHAR(121),  [...]);
PREPARE A FROM @T;
EXECUTE A;
DEALLOCATE PREPARE A;

I tested it and it works well.

edit: showed the wrapping in proc

  • 1
    Can you show the entire injection? Because afaik this will not work, as concat/char/lcase/etc will not work on table names (it didn't work with my setup; do you have some specific version you are using?). – tim Sep 21 '17 at 17:59
  • I was answering for the strtoupper() bypass, but there is some exec wrapping.Some people output a temporary script to a .sql file and then exec it back. – Nate Sep 21 '17 at 18:12
  • Chances are quite high that won't work, as almost everybody uses mysqli_query, PDO::query or similar which all doesn't allow multiple queries. – SleepProgger Sep 22 '17 at 15:42
  • Unfortunately, stacked queries are not working. With this in mind, I can neither define variables nor procedures or functions. And the database engine/plugin used is InnoDB so all tables are lowercased. I think I'm out of luck with this one and need to try another attack vector. – Sabin Nicula Sep 22 '17 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.