0

I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability.

The query time is controllable using parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [561] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [1,144] milliseconds, when the original unmodified query with value [] took [567] milliseconds.

The vulnerability report provided the following query as an example:

http://xx.xxx.xx.xxx/?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp%3A%2F%2Finput=case+randomblob%2810000000%29+when+not+null+then+1+else+1+end+

Based on my understanding, this query appears to be a test to identify the vulnerability without an actual payload. However, I would like to confirm whether this query is the payload itself or if an additional payload needs to be added to exploit the vulnerability or get into the db.

Could someone with experience in SQL injection clarify if this query is the actual payload or if there is any modification required to exploit the vulnerability effectively? Additionally, any insights on the purpose and behavior of the query would be greatly appreciated.

7
  • So, like it says, it's just the test to see the effect. There is no payload here ...
    – schroeder
    Commented Jun 19, 2023 at 11:10
  • Thank you for your response. I appreciate the clarification regarding the initial query being a test without an actual payload. However, considering the system's vulnerability to this SQL injection, I'm curious if it's possible to leverage this vulnerability by adding an additional payload to gain access to the database. Is this possible, or was the test meaningless?
    – Floppa
    Commented Jun 19, 2023 at 11:33
  • We can't tell what exactly this site might be vulnerable to or what payload might work. That's the pentester's job.
    – schroeder
    Commented Jun 19, 2023 at 12:10
  • Yes, but this website is supposedly vulnerable in testing to that URL query. I was wondering if that vulnerability can be used with an additional payload to gain access to the database.
    – Floppa
    Commented Jun 19, 2023 at 13:01
  • Schroeder is saying it might be... we have no way of knowing... This is where you call a professional in to find out. This professional is known as a penetration tester.
    – DarkMatter
    Commented Jun 19, 2023 at 18:47

1 Answer 1

0

As others commented, a pentester should confirm and explain the results as part of the service, but the answer is that the URL actually has/is the payload.

The thing is that this payload is only to detect blind sql injection (time-based) attacks.

Which means that an attacker can't retrieve information directly, but can use this payload plus a conditional SQL sentence to know if the result of a query is true or not. This way you can dump any database resource by just asking if a resource exists or not, and depending on the response time, the attacker knows if the query result is true or false.

Example from OWASP documentation:

Example combination of both queries:

1 UNION SELECT IF(SUBSTRING(user_password,1,1) =
CHAR(50),BENCHMARK(5000000,ENCODE('MSG','by 5 seconds')),null) FROM
users WHERE user_id = 1;

If the database response took a long time, we may expect that the first user password character with user_id = 1 is character '2'.

(CHAR(50) == '2')

This way, the attacker can guess/bruteforce char by char the password. This is just an example. You can query whatever you want.

In the provided payload you have to take

http://xx.xxx.xx.xxx/?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp%3A%2F%2Finput=case+randomblob%2810000000%29+when+not+null+then+1+else+1+end+

which decoded will be:

http://xx.xxx.xx.xxx/?-d+allow_url_include=1+-d+auto_prepend_file=php://input=case+randomblob(10000000)+when+not+null+then+1+else+1+end+

An attacker would replace randomblob(10000000) with a subquery. This, repeated hundreds or thousands, of times can even dump an entire table or database.

So, further exploitation will be needed to extract information from the database, but it looks possible as per the test result.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .