SQL Injection Issue Multi-line query

Question

I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as necessary. I do have permission to test against this site before people ask why I want to know the answer. I have found what I think is an injectable uname field to create a new user on the website however whenever I try and use multi-line queries the query fails to execute.Before running an INSERT query it seems that a SELECT query is run to check if the uname already exists in the system.

I'm assuming the username field is exploitable as if I create a new user with a single quote in their surname:

uname: o'connor 

I get the following verbose SQL error:

OH DEAR - unable execute SQL query: SELECT * FROM usertable WHERE uname='o'connor'

However If I try and use a semi-colon and run a multi-line statement it fails to execute, for example:

uname: admin'; UPDATE  usertable SET password='pass' WHERE uname='admin'; 

An error occurred:

OH DEAR - unable execute SQL query: SELECT * FROM usertable WHERE uname='admin'; UPDATE usertable SET password='pass' WHERE uname='admin'; '

the PHP script that processes the POST data seems to add a single quote on the end but my understanding was that my injected query would execute before reaching this single quote. Am I executing multi-line queries properly?

**UPDATE I have also tried:

uname: admin'; UPDATE  usertable SET password='pass' WHERE uname='admin'; -- 

to no avail same issue that it is unable to execute and I know all these column names and table names are correct. Is there anyway I could output the original query to a text file or something like that or when the results are returned change the value of something that is output on the page to the passwords?

Answer 1

I'm not a PHP programmer, but I believe most people use mysql_query() when executing MySQL queries in PHP and this will only allow you to execute one SQL statement at a time. It is possible to execute multiple statements in PHP, but specific steps need to be taken.

It's possible that whoever wrote this code is using mysql_query which would mean that you will not be able to inject additional SQL Statements.

SQL injection is still possible but on a much more limited level. For example you can inject sql into the where clause by passing the following value:

test' OR '1'='1

Which would generate the query:

SELECT * FROM usertable WHERE uname='test' OR '1'='1'

You could also append a UNION clause that queries another table and returns results:

test' UNION SELECT * from creditCardTable where uname = 'admin

Which would generate the query:

SELECT * FROM usertable WHERE uname='test' 
UNION 
SELECT * from creditCardTable where uname = 'admin'

Hope this helps.

Answer 2

There's absolutely no guarantee that every application will run stacked queries. In fact, the old ext/mysql extension (which is still commonly used in PHP) never supported them.

So a “naive” attack where you just append your own queries may not work here. You'll probably have to work with the original query itself. However, there are still plenty of attack techniques like manipulating the WHERE clause to fetch a different user, selecting arbitrary data through a UNION clause, possibly creating a malicious script with an INTO OUTFILE clause.