0

Burp states that a GET request have surely a SQL injection point.

I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I doing something wrong or is that a false positive?

Burp details:

The parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. The database appears to be Oracle.

FIST REQUEST

GET /sa4apc/restrict/menuApc.do?'&MVPG=ApcAssistitiRicerca HTTP/1.1
Host: test-san-as01:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://test-san-as01:8080/sa4apc/restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci
Cookie: JSESSIONIDSSO=COOKIE; JSESSIONID=COOKIE.testsan

FIRST RESPONSE (only error part)

<link rel="stylesheet" type="text/css" href="../Themes/AFC/Style.css">
Form: LogEvento<br>Errors:<br>ORA-19202: Errore durante l'elaborazione XML <br><br>Dettaglio istruzione SQL:<br>ORA-19202: Errore durante l'elaborazione XML <br>ORA-01756: stringa tra virgolette terminata in modo irregolare<br>ORA-06512: a "SYS.DBMS_XMLGEN", line 42<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO", line 736<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO_DEF", line 72<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO_DEF", line 211<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO_DEF", line 1040<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO", line 658<br>ORA-06512: a line 1<br><br>RawCommand sql='select san_log_evento.log_evento_ccs        ('{MVURL}'        ,'I'        ,'{Progetto}'        ,'{Modulo}'        ,'{Istanza}'        ,user        ,'{Utente}'        ,'{LocalName}'        ,'{LocalAddr}'        ,null        ) log_evento   from dual'<br>         where='null'<br>         order='null'<br>      countSql='SELECT COUNT(*) FROM ( select san_log_evento.log_evento_ccs ('{MVURL}' ,'I' ,'{Progetto}' ,'{Modulo}' ,'{Istanza}' ,user ,'{Utente}' ,'{LocalName}' ,'{LocalAddr}' ,null ) log_evento from dual ) cnt '<br>     sqlString='select san_log_evento.log_evento_ccs        ('/sa4apc/restrict/menuApc.do?''&MVPG=ApcAssistitiRicerca'        ,'I'        ,'SA4WEB'        ,'SA4APC'        ,'SA4WEB'        ,user        ,'CRDOPE'        ,'10.96.200.64'        ,'10.96.200.64'        ,null        ) log_evento   from dual'<br>      startPos='1'<br>     fetchSize='1'<br>    connection='cn'<br>Parameters:<br>param1 paramName: Progetto : SA4WEB type: java.lang.String<br>param2 paramName: Modulo : SA4APC type: java.lang.String<br>param3 paramName: Istanza : SA4WEB type: java.lang.String<br>param4 paramName: Utente : CRDOPE type: java.lang.String<br>param5 paramName: LocalName : 10.96.200.64 type: java.lang.String<br>param6 paramName: LocalAddr : 10.96.200.64 type: java.lang.String<br>param7 paramName: ccsForm :  type: java.lang.String<br>param8 paramName: MVURL : /sa4apc/restrict/menuApc.do?'&MVPG=ApcAssistitiRicerca type: java.lang.String<br

SECOND REQUEST

GET /sa4apc/restrict/menuApc.do?''&MVPG=ApcAssistitiRicerca HTTP/1.1
Host: test-san-as01:8080
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://test-san-as01:8080/sa4apc/restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci
Cookie: JSESSIONIDSSO=COOKIE; JSESSIONID=COOKIE.testsan

SECOND RESPONSE normal, without error

  • It's almost impossible to tell from the information you provide. Please be more verbose; what's the exact finding? Why do you expect sqlmap to be 100% correct about wether or not there's an SQLi? How did you vet the request to make sqlmap pick it up? From what do you follow that it's an oracle dbms? – Tobi Nary Feb 6 at 12:28
  • I edited with some more details. Tell me if I have to write something more please – ScTALE Feb 6 at 12:34
  • The actual request and response pairs are still missing. Also, what's your reasoning in using sqlmap? What's the content of the text file you supply as an argument? What have you tried manually? Wether or not this is a false positive (it probably is) will either be revealed by testing manually or not at all. I however suspect a problem with sqlmap usage. Still, Burp has (afair) a high percentage of SQLi-related false positives. – Tobi Nary Feb 6 at 12:39
  • In the first respond (') there is an oracle error message. In the second one ('') there isn't. In the input file (file_with_that_request.txt) I put that full GET request. I didn't try anything manually, because I thought that it was a false positive. – ScTALE Feb 6 at 12:46
  • So, include the requests and responses, use the correct placeholders for sqlmap in the request file and tell us your reasoning? An oracle error is a strong indicator that there's something not right, so probably not a false positive. But still impossible to answer with the information in your question. – Tobi Nary Feb 6 at 12:53
0

You should add --string='ORA-19' or similar at the end of the sqlmap command.

Explanation :

--string=STRING String to match when query is evaluated to True

  • 2
    That is almost certainly not the answer. – Tobi Nary Feb 6 at 14:51
  • When answering it will be very useful to not just post a single line answer but to explain why what you propose would help to answer the question. – schroeder Feb 7 at 9:59
  • This flag is needed for ensure that injection really exits or not based on error definition in response message. Of course i don't know really vulnerable or not. Other hand ORA-06512 error code refers to possible injection due to incomplete string termination that base recon step for Sqli process. – Security Team Feb 7 at 10:45
  • @SecurityTeam using that I get this warning: [WARNING] you provided 'ORA-19' as the string to match, but such a string is not within the target URL raw response, sqlmap will carry on anyway – ScTALE Feb 8 at 9:23
  • @ScTALE you may want to use '-v' parameter with '6' (-v 6 ) it will show complete response body and you can check it really works or not. You should be able to see the same error message in response if sqlmap really found the sqli. Also may you want to try first with --prefix="'" flag. It will add single quote to the request for generating same scenario. Please get more usage options from here -> (github.com/sqlmapproject/sqlmap/wiki/Usage) – Security Team Feb 8 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.