1

Although I understand the concept of a SQL injection and have done simple exploits (simple hack challenge sites and stuff) I'm wondering if one of the site run by my employer is vulnerable.

Unlike my previous experience (relating strictly to forms open for injection) it seems as though the site is sending SQL statements via the url. When manipulating the URL of a page (which is in the form of http://site.com/?action=thefaq_question&questionnr=34&categry=10) by replacing the =10 with =* for example I get error output on the page:

Error in SELECT * FROM thefaq WHERE 1  AND thefaq.site=1  AND  thefaq.id=* : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '*' at line 1

Error in    SELECT * FROM sitecontent WHERE

etc etc, the error goes on quite a bit.

Clearly SQL statements are sent via the URL, but does this make the site vulnerable by definition, i.e. is it possible there is some input validation taking place that would strip any truly malicious SQL statements from the URL before being executed?

As far as I can tell, if the URL processess SQL statements anything goes therefore it is vulnerable but I want to make sure of this before I make a fool of myself when reporting it to my employer.

---- edit ----

Mentioned this to the appropriate manager who didn't seem particularly stressed about it. Explaining that this vulnerability could result defacement or worse: user info and possible passwords being exposed (assuming they are decently hashed is probably wishful thinking) did not impress him. Website is not a priority (nor is diverting any budget to fixing the issue I suppose).

Thx for replies!

Improve this question
2
  • The fact that it displays a MYSQL generated error message in browser is a huge warning flag right away. Even if it is invulnerable to injection, an error exposing that kind of information to the user is a major security risk. Regardless of if you find a proper exploit, it should still be reported. Good find!
    – Jason Higgins
    Feb 26, 2014 at 16:51
  • Technical error messages from the DBMS or from some connection layer are a clear indication that the sent SQL statement is vulnerable to injections. Especially if the error message reflects the actually executed SQL statement with the injected part like in your case.
    – Gumbo
    Feb 26, 2014 at 22:42

1 Answer 1

Reset to default
2

The fact that you can introduce parameters on the URL is not a vulnerability per se. (For example, I love imdb.com for the ability to control with those parameters)

The fact that the sql error is output to the user, AND the fact that the query is actually run against the database shows that the site might indeed be vulnerable to sql injection.

That simple statement is enough to show to your superior that something must be done. For better effect you might want to show a complete exploit case where you run successfully some query that you were not suppose to.

Improve this answer
3
  • Thanks. I tried some simple things that I could think up. Unfortunately my knowledge of SQL query / Web development is too limited to manipulate the URL in such a way that I would be able to create an exploit case, especially without risking damage or appearing to be a hacker.
    – user3244085
    Feb 26, 2014 at 12:22
  • 1
    @user3244085 You should definitely ask the employer for permission before conducting such tests.
    – Gumbo
    Feb 26, 2014 at 22:44
  • 1
    Give &categry=10; DROP TABLE sitecontent; -- a whirl, just for funsies.
    – Stephen Touset
    Aug 5, 2014 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .