-1

I found sql injection on script that retrieve image data from database.
Ex : http://target.com/gallery.php
that contain :

<img src='getimg.php?id=1'>

and i trying access http://target.com/getimg.php?id=1
response is normal jpeg file.

I think getimg.php contains is:

<?php

  $id = $_GET['id'];
  $link = mysql_connect("localhost", "root", "");
  mysql_select_db("gallerydb");
  $sql = "SELECT image FROM gallery WHERE id=$id";
  $result = mysql_query("$sql");
  $row = mysql_fetch_assoc($result);
  mysql_close($link);

  header("Content-type: image/jpeg");
  echo $row['image'];
?>

i trying to give (') behind the url which like this :
http://target.com/getimg.php?id=1'
i get error.
but when i access the url like this :
http://target.com/getimg.php?id=1'--+-
i get no error.

i think there is sql injection.
but when i trying union select, i got error
because the header content type is jpeg.
how to solve this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.