4

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you understand!

When entering items into the database, one cannot enter a single apostrophe into the name field - users have typically resorted to using '' instead. I hence discovered this problem when attempting to parse CSV output from an export run by this program, when the value delimiting broke the parser I was using.

I spoke to the support team responsible for this 3rd party piece of software, questioning whether this was an attempt to avoid SQL injection, who confirmed that the reason for this was to "to avoid issues in SQL". Whilst this is an internal use only system, I cannot help but feel that

  1. This is horrendous coding practice - simply using prepared statements instead would instantly resolve this issue (as well as allowing single apostrophes in CSV exports and preventing a lot of hack-y workarounds as a result).

  2. There has to be some way that one can arbitrarily execute SQL without using a ' on it's own. I.e. '' or ''' is fine, just ' is not.

I raised this with my manager as soon as I discovered it (and jumped to the SQL injection conclusion), but before I really start to escalate things I would like some confirmation that it is the security hole I believe it to be (in addition to just awful coding practice).

If someone can confirm that my suspicions that would be great, and if you can come up with an example of malicious SQL code not using an isolated ', I would greatly appreciate it.

  • Sounds like injection to me. Double single-quotes is used to escape the fact that the SQL is parsing a single single-quote as code. – AlexH Feb 4 '15 at 13:19
  • It was the first thing that came into my mind when I discovered this, and the response from the support team has done nothing to allay my fears. My question is whether someone can give me a proof-of-concept that this remains a vulnerability – Authentik8 Feb 4 '15 at 13:21
  • I'll update as an answer, bit wordy for a comment. – AlexH Feb 4 '15 at 13:27
  • Same here sounds a lot like sql injection. Are you running mysql? If so you can very easily setup mysql to log all query's made. I would image other SQL software would have these feature's as well. I would think this would be the most cost efficient way to go about things unless you have advanced sql injection skills. The other option would be get your programmer to inspect the program. Only reason I say that is because if there is a vulnerability he is going to have to update the program anyway. – Tim Jonas Feb 4 '15 at 13:28
2

I'm assuming data is entered by some sort of front end, with a list of fields?

For arguments sake I'll assume 4 fields. In the first field do this:

''',(SELECT @@version), (SELECT @@version), (SELECT @@version))--

In the other fields put anything you want because they're commented out by the double dash anyway. This should return the server version to you in the second column of the data.

Edited to Add: You may need a space and another dash at the end. (So -- -)

  • It's entered through a software front end, yes - I believe the back end is Microsoft SQL Server. Apologies if I was a little unclear as to the data entry, but it's through a form with fields for each item: Name, Item code, Country, etc. – Authentik8 Feb 4 '15 at 13:43
  • Additionally, that doesn't get around the problem of the single inverted comma test',( fails their verification, but as an example, test''',( would not. – Authentik8 Feb 4 '15 at 13:46
  • 2
    Thanks, have put your suggestion in my email - little reluctant to test this out on the live program simply because it's a mission-critical system and I don't know what the knock-on effects of doing something like that are! – Authentik8 Feb 4 '15 at 14:14
  • 1
    In theory it shouldn't break anything, but you're certainly right not to try it out on a live server! They should have a dev/test server somewhere that they'll be able to verify any vulnerability on. Good luck with convincing them that something needs to change, always the hardest part! – AlexH Feb 4 '15 at 14:18
  • 1
    Definitely the hard part. Just waiting for the email that says "well it works at the moment, and we'll have to change lots of things, so can't you just deal with it?".... – Authentik8 Feb 4 '15 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.