1

Consider this code:

?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit 

Will this work out?

SQL Query:

if(isset( $_GET[ 'submit' ] ) ) {
  // Get input
  $id = $_GET[ 'id' ];

  // Check database
  $query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
  $result = mysqli_query($connection, $query);
  // Get results
  while( $row = mysqli_fetch_assoc( $result ) ) {
    // Get values
    $first = $row["first_name"];
    $last  = $row["last_name"];

    // Feedback for end user
    $html .= "<pre>ID: {$id} <br>First name: {$first} & Surname: {$last}</pre>";
  }
}

My Observation:

The same code snippet works well when I hard code it into the .php file i.e.

$query  = "SELECT first_name, last_name FROM users WHERE user_id = '' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit';";

BUT when I send it from a form, via GET, what I get:

mysqli_fetch_assoc() expects parameter 1 to be mysqli_result, boolean given

Let me know if I need to be more Verbose.

5
  • if you want to inject PHP then call it PHP injection, if badly done, you could store php code inside DB and consult the page were the code you add coud be load and maybe interpreted but injection of PHP is hard.
    – Kiwy
    May 30 '18 at 13:28
  • Correct! But not answer to the Question. Can this method work (Y/n)?Why? May 30 '18 at 13:35
  • 3
    No, at least not as you describe. May 30 '18 at 13:38
  • @FINDarkside Please let me know how can this be done. The idea works fine when I code it into .php file, but fails with that error when given through form submission. May 30 '18 at 13:40
  • 1
    @Kiwy already said it. It can be done if you dynamically modify/create the code and run it with eval or something similiar. May 30 '18 at 13:44
1

You have to understand how PHP code is run on your server.
When you request index.php to the server, what will happen is that your file name index.php will be evaluated by your php engine as is nothing more nothing less.
If your page contains a SQL request, it will be submit and the result will be use by your php code.
What you want in your case is modifying the content of index.php.
What you're suggesting could work if after the request of your SQL you had something like:

$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
  $result = mysqli_query($connection, $query);
 // Get results
  while( $row = mysqli_fetch_assoc( $result ) ) {
      // Get values
      eval( $row["first_name"]);

  }

The eval function is rarely use as it's very dangerous because it could allow in this case for example php code injection (which is far worse than mysql injection) in most case.
Without eval php will never consider a string as code and php engine will only execute static code contained in your php file.

I couldn't insist enough on the fact that you should never use eval. The cases where eval could be use are very specific and in most case reveals a design flaw in the code.

0
5

Generally, it CAN NOT be done. SQL injection only allows you to execute SQL commands. You are not directly able to use PHP.

The only way you may be able to execute PHP using SQL inejction is if the page uses eval() on un-sanitized input from DB. Few web pages will ever do this. It may be possible even if the page uses something even more rare and weird such as generating a php file to be included from DB, but this virtually never happens.

If the page uses eval on result from DB, then you just use the SQL injection to insert the code to the appropriate place in the DB (the column that is put into eval) and then visit the page that uses the eval(). Once the PHP code from the DB is passed to eval, it is executed.

3
  • You could, however, use a SELECT ... INTO OUTFILE 'file_name' to a known, accessible location with a small payload to write somewhere. May 30 '18 at 19:07
  • Alright, get it. Ways to execute PHP functions would be injecting into DB then pulling out, hoping that .php contains eval. Good enough as long as eval is used. @IsmaelMiguel how would I get the accessible directory? To use this SQL query I wanted to know the location where I would save without being noticed. That's why I tried using phpinfo(); May 31 '18 at 7:26
  • @ankushdubey I don't know personally. It may not be possible, but you can try on localhost using relative path ./ to find out, where it writes the file. If it is an useful location, such as next to the php file you used to inject or webserver root, you can use relative path from there. May 31 '18 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.