0

I have this valid GET request:

GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1
Host: test:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Referer: http://test:8080/restrict/menuApc.do?MVPG=ApcAssistitiRicerca
DNT: 1
Connection: close
Cookie: JSESSIONID=AF45C201FB75 JSESSIONIDSSO=F38B607A1D
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

I am checking the ID_ASSISTITO parameter. If I set its value to ID_ASSISTITO=ciao' I get a HTTP 200 response containing this part:

<link rel="stylesheet" type="text/css" href="../Themes/AFC/Style.css">
Form: LogEvento<br>Errors:<br>ORA-19202: Errore durante l'elaborazione XML <br><br>Dettaglio istruzione SQL:<br>ORA-19202: Errore durante l'elaborazione XML <br>ORA-01756: stringa tra virgolette terminata in modo irregolare<br>ORA-06512: a "SYS.DBMS_XMLGEN", line 42<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO", line 736<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO_DEF", line 72<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO_DEF", line 211<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO_DEF", line 1040<br>ORA-06512: a "SA4WEB.SAN_LOG_EVENTO", line 658<br>ORA-06512: a line 1<br><br>RawCommand sql='select san_log_evento.log_evento_ccs        ('{MVURL}'        ,'I'        ,'{Progetto}'        ,'{Modulo}'        ,'{Istanza}'        ,user        ,'{Utente}'        ,'{LocalName}'        ,'{LocalAddr}'        ,null        ) log_evento   from dual'<br>         where='null'<br>         order='null'<br>      countSql='SELECT COUNT(*) FROM ( select san_log_evento.log_evento_ccs ('{MVURL}' ,'I' ,'{Progetto}' ,'{Modulo}' ,'{Istanza}' ,user ,'{Utente}' ,'{LocalName}' ,'{LocalAddr}' ,null ) log_evento from dual ) cnt '<br>     sqlString='select san_log_evento.log_evento_ccs        ('/sa4apc/restrict/menuApc.do?ID_ASSISTITO=ciao''&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO='        ,'I'        ,'SA4WEB'        ,'SA4APC'        ,'SA4WEB'        ,user        ,'CRDOPE'        ,'10.96.200.64'        ,'10.96.200.64'        ,null        ) log_evento   from dual'<br>      startPos='1'<br>     fetchSize='1'<br>    connection='cn'<br>Parameters:<br>param1 paramName: Progetto : SA4WEB type: java.lang.String<br>param2 paramName: Modulo : SA4APC type: java.lang.String<br>param3 paramName: Istanza : SA4WEB type: java.lang.String<br>param4 paramName: Utente : CRDOPE type: java.lang.String<br>param5 paramName: LocalName : 10.96.200.64 type: java.lang.String<br>param6 paramName: LocalAddr : 10.96.200.64 type: java.lang.String<br>param7 paramName: ccsForm :  type: java.lang.String<br>param8 paramName: MVURL : /sa4apc/restrict/menuApc.do?ID_ASSISTITO=ciao'&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= type: java.lang.String<br> 

Therefore, I suspect that this is a point for a error-based SQL injection. But, if I set the parameter with values similar to this ID_ASSISTITO=ciao or 1=1 I get a 404 not found response.

Is that a false positive SQL injection point? What other payloads shoud I try? (Oracle database)

  • Is this not the same or really similar to your other question: security.stackexchange.com/questions/204698/… ? – schroeder Mar 5 at 10:49
  • This one is more specific because through manual testing I am quite sure that there could me an error-base sql injection point and my question should be more precise – ScTALE Mar 5 at 11:02
  • Ah, ok. Would knowing the content in your other question help this one? Should they be linked? – schroeder Mar 5 at 11:03
  • mmm, maybe yes.. – ScTALE Mar 5 at 11:04
  • Have you tried with ID_ASSISTITO=ciao' or '1'='1 ? Since your input is string this variant might work. – Rahul Mar 18 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.