0

I have a URL http://localhost/usernfo.php?id=8 on which SQL injection can be performed.

How can I perform an Update, Insert or Delete command from this link after I have got the structure of the database?

  • It depends on how you succeeded to perform the injection. Tell us how you did that and we could help. – user45139 Jul 30 '15 at 13:48
2

Lets say the application uses the id parameter (which is in your example 8) to create the following query:

SELECT * FROM news WHERE id=8 and active=1

If the parameter id is injectable, you could for example in the URL instead of 8 enter the following:

8; UPDATE table_name SET filed=123456 --

That would turn the first query into:

SELECT * FROM news WHERE id=8; UPDATE table_name SET filed=123456 -- and active=1

With ; you are closing the first query, and with -- you are commenting out if anything remained from the first query.

  • 6
    Sorry but it depends, if the underlying function is mysql_query (php) as example, it doesn't support stacked queries. (sqlinjection.net/stacked-queries) – r00t Jul 30 '15 at 13:43
  • @r00t, if someone is going to inject an insert or update statement this is how it would be done though, correct? I understand that it might not be possible, depending on the underlying code, but I don't know of another way to do it. – Abe Miessler Jul 30 '15 at 14:36
  • 3
    @AbeMiessler : Yes sure, but the answer should be clear on the fact that it's not always possible to UPDATE/DELETE/INSERT. The OP asked "how can i perform[...]" and the exact answer is : you may be able to do it like the pineappleman said or may not be able to do it at all. Also, the answer is assuming the underlying request is a SELECT but the GET var could also be used in an UPDATE/DELETE/INSERT or a stored procedure, etc.. so the answer is not covering all cases. – r00t Jul 30 '15 at 14:51
  • 1
    @r00t The OP specified that we should assume that "SQL injection can be performed". – TTT Jul 30 '15 at 19:16
  • 3
    @TTT : Yes, but it's not because "SQL injection can be performed" that you can execute INSERT, UPDATE AND DELETE statements... – r00t Jul 30 '15 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.