2
  1. Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case.

  2. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get only SQL errors on the page.

  3. On executing the query directly on mysql server ie SELECT * FROM users WHERE id = '2' ORDER BY 1;--''; I get the below result that is 1 row set along with the error.

mysql> SELECT * FROM users WHERE id = '2' ORDER BY 1;--'';
+----+----------+-----------+------------------+
| id | username | password  | creditcard       |
+----+----------+-----------+------------------+
|  2 | John     | password! | 3123456769384659 |
+----+----------+-----------+------------------+
1 row in set (0.00 sec)

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--''' at line 1


PHP code

<?php

require_once 'login.php';
if (!isset($_GET['id']))
{
    echo <<<_END
    <pre>            <h1>WELCOME to the KINGDOM</h1>
    <form action = 'si2.php' method = 'GET'>
    id <input type = 'text' name = 'id'>

        <input type = 'submit' value = 'cl1ck M3'></pre></form>
 _END;

}

if(!get_magic_quotes_gpc())
{
    $id = stripslashes($_GET['id']);

}
$connection = mysql_connect($db_hostname,$db_username,$db_password);
if(!$connection) die ("Unable to connect with MySql " . mysql_error());

 mysql_select_db($db_database,$connection) or die('Could not connect with the database');

$query = "SELECT * FROM users WHERE id = '$id'";

$result = mysql_query($query);
if($result)
{
    $rows = mysql_num_rows($result);
}
else { echo "Could not execute the Query:  <br>" . mysql_error();}


if($rows >= 1)
    {

        for ($j=0 ; $j < $rows; ++$j)
            {
                $row = mysql_fetch_row($result);
                echo "Hello $row[1]"."<br>";
                echo "Your Credit Card Number is  $row[3]"."<br><br>";
                echo $query."<br>";
                //echo $row[3];

            }
    }           
else
{
    echo "<br><br><br>Sorry no rows/results could be fetched on query execution <br><br><br>";
    //echo $query;
}
?>

My question is why my code isn't able to fetch the row set and displaying the table entries ? And in case I want to then what changes should I try.

2

Error and Problems in your injection

The problem is that you cannot execute multiple queries with mysql_query, and as you are injecting a ; you have multiple queries. The first one is SELECT * FROM users WHERE id = '2' ORDER BY 1 and the second one is --''.

The first one is the one that gives you the actual result in the command line, and the second one gives you your error (because it's not a valid query).

Note also that your injection: 2' ORDER BY 1;--' doesn't make all that much sense. Why do you have the ;? You don't really want to execute two queries, just one. And what is the last ' supposed to do? You already took care of the leftover ' by commenting it out via -- (at least in theory).

Solution

What you want to inject is 2' ORDER BY 1--, or, if that doesn't work, try using # (url encoded as %23 if you use a browser) instead of -- as comment character to cut of the rest of the query (the '), because it does not require an additional whitespace. In some cases you could also build the query in a way that the left over ' is used, such as OR '1' = '1 (this probably doesn't work for order by though).

  • Your clear description has explained where I's going wrong. – harveyD Mar 26 '15 at 1:18
1

There are possibly two issues with your attempt that cause it to fail:

  • Is that considered multiple queries? – Abe Miessler Mar 25 '15 at 18:07
  • @AbeMiessler I’m not sure. – Gumbo Mar 25 '15 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.