Adding Payload to URL-based SQL Injection: Seeking Guidance and Best Practices

Question

I recently performed a vulnerability assessment on a system using ZAP (Zed Attack Proxy) and received a finding indicating a likely SQL injection vulnerability.

The query time is controllable using parameter value [case randomblob(1000000) when not null then 1 else 1 end ], which caused the request to take [561] milliseconds, parameter value [case randomblob(10000000) when not null then 1 else 1 end ], which caused the request to take [1,144] milliseconds, when the original unmodified query with value [] took [567] milliseconds.

The vulnerability report provided the following query as an example:

http://xx.xxx.xx.xxx/?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp%3A%2F%2Finput=case+randomblob%2810000000%29+when+not+null+then+1+else+1+end+

Based on my understanding, this query appears to be a test to identify the vulnerability without an actual payload. However, I would like to confirm whether this query is the payload itself or if an additional payload needs to be added to exploit the vulnerability or get into the db.

Could someone with experience in SQL injection clarify if this query is the actual payload or if there is any modification required to exploit the vulnerability effectively? Additionally, any insights on the purpose and behavior of the query would be greatly appreciated.

Answer 1

As others commented, a pentester should confirm and explain the results as part of the service, but the answer is that the URL actaully has/is the payload.

The thing is that this payload is only to detect blind sql injection (time-based) attacks.

Which means that an attacker can't retrieve information directly, but can use this payload plus a conditional SQL sentence to know if the result of a query is true or not. This way you can dump any database resource by just asking if a resource exists or not, and depending on the response time, the attacker knows if the query result is true or false.

Example from OWASP documentation:

Example combination of both queries:

1 UNION SELECT IF(SUBSTRING(user_password,1,1) = CHAR(50),BENCHMARK(5000000,ENCODE('MSG','by 5 seconds')),null) FROM users WHERE user_id = 1;

If the database response took a long time, we may expect that the first user password character with user_id = 1 is character ‘2’.

(CHAR(50) == '2')

OWASP Documentation

This way, the attacker can guess/bruteforce char by char the password. This is just an example. You can query whatever you want.

In the provided payload you have to take

http://xx.xxx.xx.xxx/?-d+allow_url_include%3D1+-d+auto_prepend_file%3Dphp%3A%2F%2Finput=case+randomblob%2810000000%29+when+not+null+then+1+else+1+end+

which decoded will be:

http://xx.xxx.xx.xxx/?-d+allow_url_include=1+-d+auto_prepend_file=php://input=case+randomblob(10000000)+when+not+null+then+1+else+1+end+

An attacker would replace randomblob(10000000) with a subquery. This, repeated hundreds or thousands, of times can even dump an entire table or database.

So, further exploitation will be needed to extract information from the database, but it looks possible as per the test result.