0

I have this site with the following parameters:

http://www.example.com.com/pagination.php?page=4&order=comment_time&sc=desc

I use the values of each of the parameters as a value in a SQL query.

I am trying to test my application and ultimately hack my own application for learning purposes.

I'm trying to inject this statement:
http://www.example.com.com/pagination.php?page=4&order=comment_time&sc=desc' or 1=1 --

But It fails, and MySQL says this:

Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /home/dir/public_html/pagination.php on line 132

Is my application completely free from SQL injection, or is it still possible?

EDIT: Is it possible for me to find a valid sql injection statement to input into one of the parameters of the URL?

4
  • What happens if you try to append some after the order? I assume the order generates 'ORDER BY comment_time'. So I could play with Adding UNION 1,2,3,4,5 FROM sysobjects until I got an acceptable number of fields (matching my UNION to table results). Once that happened, I could start poking around all your system tables..
    – Sparky
    Oct 2, 2011 at 4:04
  • So Your're saying replace order=comment_time with order=UNION 1,2,3,4,5
    – user975096
    Oct 2, 2011 at 4:06
  • I'll show you an example in the answer section rather than comments
    – Sparky
    Oct 2, 2011 at 4:08
  • @user975096: "Is it possible for me to find" --- as long as you don't know - it is not possible for you to find anything. Give the url to your site and see :-)
    – zerkms
    Oct 2, 2011 at 4:08

5 Answers 5

2

The application secured from sql injection never produces invalid queries.

So obviously you still have some issues.

Well-written application for any input produces valid and expected output.

4
  • This answer isn't helpful at all, in that it provides no explanation of how to eliminate invalid inquiries, sanitize input, etcetera. Boann's answer above provides two options for sanitizing input with limited values; Question Overflow's answer below provides a means of string sanitization; lastly, if you need free text input, read up on mysqli_real_escape_string @ php.net/manual/en/mysqli.real-escape-string.php
    – Doktor J
    Apr 2, 2014 at 17:32
  • @Doktor J: The question was: "Is my application completely free from SQL injection, or is it still possible?". My answer answers this question directly. OP did not ask how to protect against it, just asked if it's a valid behaviour or not. So, if it's not helpful for you - okay, but next time please read the question more carefully. Thank you!
    – zerkms
    Apr 2, 2014 at 20:16
  • It's a matter of give a man a fish/teach a man to fish. While you did technically answer the question, providing more background and information on how to correct the problem is more useful to others who may visit this question than just "nope you have a problem". So I suppose my earlier statement of "isn't helpful at all" is an overstatement... but it could still stand to be significantly more helpful.
    – Doktor J
    Apr 3, 2014 at 0:27
  • @Doktor J: there are hundreds of articles about how to protect against sql injections. No reason to provide at least something if you don't provide a comprehensive description. It would be more harm than good. Instead of that I provided a statement that OP could use to work on.
    – zerkms
    Apr 3, 2014 at 0:39
2

That's completely vulnerable, and the fact that you can cause a syntax error proves it.

There is no function to escape column names or order by directions. Those functions do not exist because it is bad style to expose the DB logic directly in the URL, because it makes the URLs dependent on changes to your database logic.

I'd suggest something like an array mapping the "order" parameter values to column names:

$order_cols = array(
    'time' => 'comment_time',
    'popular' => 'comment_score',
    ... and so on ...
);

if (!isset($order_cols[$_GET['order'])) {
    $_GET['order'] = 'time';
}
$order = $order_cols[$_GET['order']];

Restrict "sc" manually:

if ($_GET['sc'] == 'asc' || $_GET['sc'] == 'desc') {
    $order .= ' ' . $_GET['sc'];
} else {
    $order .= ' desc';
}

Then you're guaranteed safe to append that to the query, and the URL is not tied to the DB implementation.

0

I'm not 100% certain, but I'd say it still seems vulnerable to me -- the fact that it's accepting the single-quote (') as a delimiter and then generating an error off the subsequent injected code says to me that it's passing things it shouldn't on to MySQL.

Any data that could possibly be taken from somewhere other than your application itself should go through mysql_real_escape_string() first. This way the whole ' or 1=1 part gets passed as a value to MySQL... unless you're passing "sc" straight through for the sort order, such as

$sql = "SELECT * FROM foo WHERE page='{$_REQUEST['page']}' ORDER BY data {$_REQUEST['sc']}";

... which you also shouldn't be doing. Try something along these lines:

$page = mysql_real_escape_string($_REQUEST['page']);
if ($_REQUEST['sc'] == "desc")
  $sortorder = "DESC";
else
  $sortorder = "ASC";

$sql = "SELECT * FROM foo WHERE page='{$page}' ORDER BY data {$sortorder}";

I still couldn't say it's TOTALLY injection-proof, but it's definitely more robust.

3
  • if you are passing the "sc" variable straight through in the SQL like I mentioned above, a valid (and destructive!) URL could be http://www.example.com.com/pagination.php?page=4&order=comment_time&sc=desc;DROP TABLE FOO
    – Doktor J
    Oct 2, 2011 at 4:13
  • "Any data that could possibly be taken from somewhere other than your application itself" --- even the data taken from your own database should be sanitized with mysql_real_escape_string
    – zerkms
    Oct 2, 2011 at 4:15
  • Right; I was specifically referring to statically-coded values, such as the $sortorder variable I used in my example.
    – Doktor J
    Oct 2, 2011 at 4:33
0

I am assuming that your generated query does something like

select <some number of fields>
from <some table>
where sc=desc
order by comment_time

Now, if I were to attack the order by statement instead of the WHERE, I might be able to get some results... Imagine I added the following

comment_time; select top 5 * from sysobjects

the query being returned to your front end would be the top 5 rows from sysobjects, rather than the query you try to generated (depending a lot on the front end)...

3
  • ; (and multiple queries as well) is not allowed in mysql_query
    – zerkms
    Oct 2, 2011 at 4:14
  • OK, I didn't see you were using mySQL. I see it now in the body of the message, but not as a tag.. I am not sure what the delimiter is in mySQL, but I would consider the ORDER BY as a potential attack point...
    – Sparky
    Oct 2, 2011 at 4:18
  • I'm not the OP :-) ; is the delimiter in mysql but mysql_query doesn't allow to use it.
    – zerkms
    Oct 2, 2011 at 4:19
0

It really depends on how PHP validates those arguments. If MySQL is giving you a warning, it means that a hacker already passes through your first line of defence, which is your PHP script.

Use if(!preg_match('/^regex_pattern$/', $your_input)) to filter all your inputs before passing them to MySQL.

2
  • defense is spelled with an "S" not a "C"
    – user975096
    Oct 2, 2011 at 7:13
  • It depends whether you are writing American or British English ;p Oct 2, 2011 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.