3

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check.

Now I tried Acunetix scanner and it found both blind SQL and normal SQL injection on the website. I need to show my client there is actually a flaw so I used sqlmap with various options

Like I know the backend DB is mysql, —skip-WAF

Ok endpoint /find/1* Which means to inject at positive of asterisk.

Sqlmap performed detail evaluation however couldn’t exploit the vulnerability. I did the risk and verbose to see the queries myself as well.

What I noticed that * is marked as non permitted character in config of code ignitor which prevents sqlmap from making select * from... etc queries.

My Question:

Shall I assume that the website is safe? Since I can see in the code that sanity check has not been performed on the “input data”.

  • Not every flaw is exploitable. But the asterisk can be urlencoded as %2A so I would perhaps try that or add some whitespace. Maybe use a fuzzer to generate more combinations than SQLmap would. Many applications perform validation with regular expressions, but a common flaw is that the regular expression does not expect multiline input, thus you can still inject malicious content. – Anonymous Mar 31 at 19:54
  • Thanks.. do you know which tamper to use for * in sqlmap? – Badddy Mar 31 at 20:04
0

It depends on what you mean by "no sanity check" is performed on the input parameter. If this means that the application takes the parameter, concatenates it into a SQL query and sends it to the database, the application is vulnerable for sure. Only blocking * is not enough to protect against SQL injection.

Never assume the site is safe, if you have doubts about it! Even if you are not able to create a working exploit, you should recommend implementing database queries using prepared statements (or similar mechanisms). It is considered best practice and there is usually no reason not to use them.

| improve this answer | |
  • Yes jt concatenates with query and send to DB. However I meed to show PoC to my client for recommendations – Badddy Mar 31 at 16:31
  • Creating a PoC should be easy, if you have access to the source code. Just create a query that proves that SQL syntax is executed. I cannot offer anything generic without the source and without a test system to try things out. If you have permission to do so, you can post the relevant part of the source code here and the community can have a look. – Demento Mar 31 at 16:35
  • Can you suggest any appended query based on the query i mentioned above that does shows sql injection exist or any way to tamper * in sqlmap please – Badddy Mar 31 at 16:39
  • Without the source code it is just guessing, but if a query like "1 and 1=1-- x" executes and returns the vehicle with ID 1, you can be pretty sure that the SQL injection works. If it doesn't work, this means nothing! There is no generic PoC and you must adapt the PoC to the application. If my example works and you want to be really sure, send "1 and 1=2-- x" and see if it works again. If it works with the first but not with the second sequence, you can be pretty sure that's an SQL injection. – Demento Mar 31 at 16:53
  • When I tried first one. The app throws an error with the query .. Select * From vehicle where (title Like ‘%1’1%20and%201=1 OR engine_no Like <same as with title) order by id desx – Badddy Mar 31 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.