Weird condition in blind SQL injection point, substr() is valid for exactly two chars

Question

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table.

(It's running MySQL 5.X with PHP)

So I'm using this to retrieve all databases:

valid_user_name' and (
    SELECT substr(hex(schema_name), 8, 1) 
    FROM information_schema.schemata 
    WHERE schema_name not in ('performance_schema','mysql','information_schema')    
    ORDER BY schema_name limit 0, 1) = '9' #

The first database name is radius, so the 8th char of hex('radius') is '9'. With the input above the web page shows the user exist.

But when I provide character '7' it also shows the user exist.

All the rest do not show so.

Anyone know why?

P.S You might thought the injection point is a false positive, but it's not. I have confirmed that with SQLmap.

Answer 1

It seems like there's something strange going on in the way you are iterating through the comparisons.

The thing that makes me raise my eyebrows when I look at this is that you are comparing hex values 1 byte at a time. This is technically okay but it will be harder to reconstruct the table names afterward.

So, breaking it down:

1. You know you have a target table name of 'radius'
2. The ASCII hex value of that string that is generated by hex() is "726164697573"

Comparing the strings should be done like this:

r  a  d  i  u  s
72 61 64 69 75 73

You want to be comparing those hex values 2 bytes at a time:

valid_user_name' and (
    SELECT substr(hex(schema_name), 7, 2) 
    FROM information_schema.schemata 
    WHERE schema_name not in ('performance_schema','mysql','information_schema')    
    ORDER BY schema_name limit 0, 1) = '69' #

My guess is that there is an error in your iteration code that is either related to the 1-byte comparison, some kind of off-by-one error, or a combination of both.