Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case:

  1. The only protection in the PHP code is mysql_real_escape_string().
  2. The query is constructed in double quotes: "select id from db where id = $id" not single string literal quotes.
  3. The database is mysql (using mysql_query php call) so I don't think stacked queries is possible (correct me if I'm wrong).
  4. Using mysql not mysqli.

I've tried using something like 1; update users set first_name = foo with no luck and tried passing in commas ' in hex and octal format with no luck: chr(0x27) char(0x27) chr(047) ascii tables.

Is it possible to actually update or insert under these conditions?

  • 1
    @Rook so what are the alternatives for updating or inserting data? – Crizly Nov 11 '14 at 17:43
  • Point 2 is irrelevant. It is only the quoting within the query that can affect SQLi, not how it is represented in PHP. – SilverlightFox Nov 11 '14 at 22:34
  • @SilverlightFox if it was "select id from db where id = '$id'" that would make it more difficult, no? – Crizly Nov 11 '14 at 23:25
up vote 2 down vote accepted

Query stacking, ie select * from tbl; update ... -- is forbidden by most database management systems. In order to enable query stacking in PHP/MySQL, the application must use the mysql_mutli_query() function to execute the query. This function is uncommon in the wild.

In SQL injection without query stacking, the attacker is limited by accessible query operators, and SQL functions. The tool SQLMap allows an attacker to access functionality exposed by SQL injection with an easy to use shell. The example sql injection vulnerability provided maybe blind sql injection, which can be exploited with SQLMap.

In MySQL, an attacker can append a union select to access other tables:

select id from db where id = 1 union select password from users

or a sub-select:

select id from db where id = (select password from users)

Additionally an attacker could read file using the load_file() function:

select from db where id = load_file('/etc/passwd')

Only select statements can use the into outfile query operator:

select from db where id = 1 union select password from users into outfile '/var/www/backup.txt'

The into outfile operator requires the use of single-quotes and cannot be used in a SQL injection exploit when mysql_real_escape_string() is used.

The paper Hackproofing MySQL is still relevant, and covers these attacks, and more.

  • Just to clarify - it is not possible to update a field or insert a record correct in the scenario he presented, correct? – Abe Miessler Nov 11 '14 at 18:25
  • @Abe Miessler Good point, updated. – rook Nov 11 '14 at 18:28

It may be possible using select into SELECT id FROM table1 WHERE id = 1 INTO table2 However as the attacker does not directly control the id value the attacker would need another method of controlling this data for the attack to be able to have a meaningful impact.

  • I'm reading about this at the moment, do you happen to know any methods of controlling the data? – Crizly Nov 12 '14 at 14:04
  • 1
    "MySQL Server doesn't support the SELECT ... INTO TABLE Sybase SQL extension. Instead, MySQL Server supports the INSERT INTO ... SELECT". The into table query operator cannot be in the OP's injection. – rook Nov 12 '14 at 15:28
  • While true for this specific example (and clearly documented in the referenced link) I feel it would be an oversight not to mention it so if a MSSQL user reads this they don't walk away thinking they are safe. – wireghoul Nov 13 '14 at 22:32
  • @Crizly control of the data and the impact it could have would be application specific. – wireghoul Nov 19 '14 at 22:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.