0

I have a SquirrelMail server setup, and when I play with the mailbox parameter in the following GET query

example.com/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=Drafts%2Ftest

I get the following error message (image attached as well):

ERROR: Could not complete request. Query: SELECT "Drafts/test" Reason Given: Mailbox doesn't exist: Drafts/test (0.001 + 0.000 secs).

I was wondering whether this could mean that the site is vulnerable to a SQL injection, and what commands I could try to verify this.

Error message received

  • 1
    It doesn't look like the error message printed the actual SQL query... Just the query SELECT "foo" would just return the value foo without doing an actual query of data in the database. The database itself would never know that you're looking for a database by name based on that query. -- The error message wouldn't make me think that a SQL injection were possible. Try throwing apostrophes, backslashes, percent signs, and the like at various parts of the URL, i.e., "mailbox=%25a%25" to try to match any mailbox that has a lowercase A in its name: "%a%". – Ghedipunk Mar 5 at 21:12
  • If it doesn't filter it when it comes back, that error screen might be vulnerable to XSS too. But nothing you've shows us indicates that it is. P.S. I'm fairly sure they're running squirrelmail, which you can freely download and see how right_main.php handles its input. – JeffUK Mar 6 at 11:36
  • You might wanna try database() in your mailbox= parameter. If it spits out the database name then it's leaking critical information for sure and such error messages shouldn't be displayed. – Rahul Mar 18 at 18:44
1

I'm afraid there isn't much information to go on here in terms of answering your question. SQL injection vulnerabilities make themselves visible through very specific error messages, showing the server's inability to handle the SQL query being passed to them. As a corollary, in order to find that error message, you'll need to make sure you're querying on something that will transform into SQL and inject itself into the server.

It sounds like SQL injection attacks might be something you're not too familiar with, so I'd suggest doing a little more background research. I find this Computerphile video to be especially educational on the topic. And to try out SQL injection on an application that is vulnerable, I'd play around with Juice Shop (from OWASP).

Hope this helps! Feel free to ask any more questions you have on this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.