1

In this blogpost describing a pentest, the author adds ' to a field requiring some value, and concludes that there is an SQLi vulnerability:

Upon further investigation adding a single quote would make the server return a 500 status error, which.... SCREAMS SQLi

Does an HTTP 500 code mean it is vulnerable to SQLi? Or do all HTTP error codes mean it is an SQL injection? Which HTTP code do not mean an SQLi?

2

There are no error code for sql injections. HTTP status code 500 just means an internal server error. When being able to break the code by just adding some special characters, the code is vulnerable to a SQL injection as the input is not sanitized,

For example:

$sql = "SELECT * FROM mytable WHERE name = '$name'";

When adding "Jose's" into the field, the SQL statement would be:

$sql = "SELECT * FROM mytable WHERE name = 'Jose's'";

which would be an error in the syntax.

If the input is not sanitized you could now add additional SQL statements after the ' and therefore run your own sql statements.

  • So HTTP 500 error doesn't necessarily mean it is vulnerable to SQL injection right ? But the author is saying that HTTP 500 means confirmed SQLi ??? PLZ clarify – nothing1 Oct 27 '17 at 17:13
  • 1
    Its the combination of receiving that code after adding a single quote to the input field. A 500 means "Internal Server Error". One of the most common causes of this is SQL injection. A ' character in SQL terminates a string. If the user provided field is placed verbatim in the query then you would end up with invalid SQL because there would be an odd number of ' characters - which would throw an exception and likely cause a 500. – Hector Oct 27 '17 at 17:21
  • 4
    Yeah. It is evidence for SQL Injection - the author is using hyperbole. It almost certainly is, but it could be other things - including other query languages (LDAP, various nosql queries, something proprietary) or a very bad sanitizer (that explodes when it hits a bad character rather than filtering or properly rejecting it) or other things. But most pen testers would lay money on SQL Injection given these circumstances – crovers Oct 27 '17 at 19:46
2

Does an HTTP 500 code mean it is an SQLi?

A 500 error code means Internal Server Error. Please take a look here for HTTP status codes and their meanings. A 500 code in this case (when adding a single quote) does not neccessarily mean that it is an SQLi, because it can have other causes (bad SQLi prevention, other parsing issues). But chances are really good, that it is an SQLi!

or do all HTTP error codes mean it is an SQL injection?

No. For example a 400 (Bad Request) could be given, as single quotes are not permitted. This could indicade that an SQLi is prevented (in a dirty way).

Which HTTP code do not mean an SQLi?

That's never sure, because SQLi prevention usually escapes the string and stores it in the database, while everything is working normal an no exceptions are thrown. So in both cases (SQLi and prevented SQLi) the response code could be 200 (OK).

-1

Let's say the URL looks like this:

http://anysite.com/somefile.php?id=1

And the query becomes:

SELECT * FROM product WHERE id='1'

Now, when you try to inject the single quote in it like this:

http://anysite.com/somefile.php?id=1'

Then the query becomes this:

SELECT * FROM product WHERE id='1''

But here you put the single quote in it so it will return the syntax error always. Because database can not fulfil the query so it will return the syntax error. Note point is database is returing the error not the server. So, there is no relation between the 500 server error to the SQL error.

Note: Developers can hide the syntax error by using the @ or use of some other, so that you can not see the syntax error. Then, blind SQL comes to the rescue.

  • What version of SQL suppresses errors with a '@'? – symcbean Apr 5 '18 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.