CODEWITHSUNDEEP
sql-servert-sqlsql-injection
Lukas
Lukas

Reputation: 2923

SQL Injection, ignore first select command

I am trying to build a scenario that would allow me to expose additional data from a server (for case-demo purposes). The server calls a vulnerable SQL code:

EXEC my_storeProc '12345'

where "12345" (not the single quotes) is the parameter. This performs a SELECT statement. I would like to eliminate this execution and instead call my own select statement, however the server side code will only accept the first select statement called, contained within the aforementioned EXEC call. Calling the second statement is easy:

EXEC my_storeProc '12345       ' select * from MySecondTable--

(the -- at the end will block the closing single quote added by the server to prevent errors). My problem is that although there are 2 select statements, the server will only parse the first one. Is there a way to cancel the first EXEC call without throwing an error so that the second one would be taken instead? Perhaps even a UNION but there isn't much I can do with only one variable open to exploit (variable being 12345 in this case).

Upvotes: 0

Views: 3180

Answers (1)

Randall
Randall

Reputation: 1521

You have to think of how it will be executed, specifically you want it called so it doesn't raise an exception and put the kabosh on the whole statement. You can't set the result to always true with a proc call, so there is no real way escape the proc. Instead, you'll want to slip a second command in, Your desired code looks like;

exec my_Storeproc '1234'; select * from mysecondtable

So we need to close the quotes, and make a new statement. That would mean the string with the insert needs to be;

1234'; select * from mysecondtable where 1 = '1

There is a flaw in this, whatever command you are executing is not being returned to the UI. To get the data you'll have to add a server connection to the second command.

To make the second command unnecessary you would have to inject code into the proc, which is a non starter since the proc is already complied and sql injection relies on confusing the compiler as to what is data and what is commands. For a more verbose explanation of that check out this answer:

https://security.stackexchange.com/a/25710

Upvotes: 2

Related Questions