0

I have a sqli and i can dump data from the DB with the query below func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(uid,':',email,':',password) FROM user WHERE uid=56; --&token=6eadee0862e6fe05d588cb29c416d9

How can i add an update query to change the password? I've tried the query below but it did't work

func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,UPDATE
users SET password='xxxxxxx'; --&token=6eadee0862e6fe05d588cb29c416d9
1

The language/database framework on the server side is the best indicator on whether or you will be able to use stacked queries. If you can use stacked queries (executing multiple statements in one query: select * from users;drop table users;) it may be wiser to insert a user of your own, rather than altering an existing user.

If stacked queries are not possible you can often perform a password reset operation and then dump the password reset token from the database and use it to reset any users password.

As mentioned in other answers, you might be able to craft a webshell using union select into outfile for example. However that is often not feasible as it is a privileged database operation and requires the database server and web server to share the same file system and have weak permissions inside the web root.

1
  • Great answer, but it may help to take a moment to define "stacked queries". I've never heard that phrase before myself but was able to guess from context. Aug 4 '20 at 1:55
-1

Short answer: quite probably, you cannot. But if you can dump the current password and assuming it's not even hashed is that a problem ?

However, you may be able to upload a shell using SQLmap for example. Then you could possibly take over the server and perform more aggressive action, like altering the database.

3
  • So it's not possible to run update statements via sql injection!
    – Ombre
    Aug 3 '20 at 19:00
  • Do a search for: stacked queries. But whether you can do that depends on the database system but also the programming language involved eg PHP.
    – Anonymous
    Aug 3 '20 at 19:22
  • While true, it would help to explain why this probably won't work. Aug 4 '20 at 1:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.