1

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error())

Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a user.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"email@email.com""' at line 1

mysql_query('SELECT * FROM users WHERE users_email_address = "'.$email.'") or die(mysql_error());

I was able to crash the browser with email@email.com" OR "" = ... since I'm assuming that caused an infinite loop

First part of question is ... how would I exfiltrate information with this " condition I have found? Is there a special name for it other than SQL injection that I can read more about?

Second part of question is: The mysql_error output seems like it could be advantageous for a wannabe intruder, but I am unaware of the depth of information it could provide.

2

First part of question is ... how would I exfiltrate information with this " condition I have found? Is there a special name for it other than SQL injection that I can read more about?

No, this is exactly SQL injection. If the results of the query are being printed, it's possible to use UNION to mix in data from other tables that are not intended to be disclosed. Even if the results of the query aren't printed, blind SQL injection can be used to map out the contents of the database one character at a time. If found in a login form, authentication bypass is a possibility.

It's a complex specialty area of security; some might consider writing valid SQL queries to be hard enough on it's own without throwing the injection curve in. There's a decent cheat sheet here, and all sorts of tutorials of varying quality available on the web.

Second part of question is: The mysql_error output seems like it could be advantageous for a wannabe intruder, but I am unaware of the depth of information it could provide.

Firstly, it's a large flag indicating that SQL injection is possible. But secondly, when an intruder is attempting SQL injection, having detailed error messages makes it easier for them to adapt their queries to get something that runs properly - messages like the one above pinpoint where the query went wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.