0

I have a SquirrelMail server setup, and when I play with the mailbox parameter in the following GET query 

example.com/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=Drafts%2Ftest

I get the following error message (image attached as well):

ERROR: Could not complete request. Query: SELECT "Drafts/test" Reason Given: Mailbox doesn't exist: Drafts/test (0.001 + 0.000 secs).

I was wondering whether this could mean that the site is vulnerable to a SQL injection, and what commands I could try to verify this.

Error message received

Improve this question
3
  • 1
    It doesn't look like the error message printed the actual SQL query... Just the query SELECT "foo" would just return the value foo without doing an actual query of data in the database. The database itself would never know that you're looking for a database by name based on that query. -- The error message wouldn't make me think that a SQL injection were possible. Try throwing apostrophes, backslashes, percent signs, and the like at various parts of the URL, i.e., "mailbox=%25a%25" to try to match any mailbox that has a lowercase A in its name: "%a%".
    – Ghedipunk
    Mar 5, 2019 at 21:12
  • If it doesn't filter it when it comes back, that error screen might be vulnerable to XSS too. But nothing you've shows us indicates that it is. P.S. I'm fairly sure they're running squirrelmail, which you can freely download and see how right_main.php handles its input.
    – JeffUK
    Mar 6, 2019 at 11:36
  • You might wanna try database() in your mailbox= parameter. If it spits out the database name then it's leaking critical information for sure and such error messages shouldn't be displayed.
    – Rahul
    Mar 18, 2019 at 18:44

1 Answer 1

Reset to default
1

I'm afraid there isn't much information to go on here in terms of answering your question. SQL injection vulnerabilities make themselves visible through very specific error messages, showing the server's inability to handle the SQL query being passed to them. As a corollary, in order to find that error message, you'll need to make sure you're querying on something that will transform into SQL and inject itself into the server.

It sounds like SQL injection attacks might be something you're not too familiar with, so I'd suggest doing a little more background research. I find this Computerphile video to be especially educational on the topic. And to try out SQL injection on an application that is vulnerable, I'd play around with Juice Shop (from OWASP).

Hope this helps! Feel free to ask any more questions you have on this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .