CODEWITHSUNDEEP
phpsqlmysqlisql-injection
brian michelson
brian michelson

Reputation: 55

Why can I not perform SQL injection on this vulnerable script?

could you please tell me why my SQL-Injection isn't working and how can I fix it. I tried to go after the example from Here, but value'); DROP TABLE table;-- or password 1=1 doesn' work. Im sorry to steal your time with these easy things, but I tried it many times and I didn't get it running and the other post didn't help me.

<?php

$connection = mysqli_connect('localhost', 'root','' ,'DB') or die(mysqli_error());
mysqli_select_db($connection ,'DB')or die(mysqli_error());
@$unsafe_variable = $_POST['vorname'];
mysqli_query($connection, "INSERT INTO `Persons` (`Vorname`) VALUES ('$unsafe_variable')");

Upvotes: 0

Views: 1765

Answers (1)

dani herrera
dani herrera

Reputation: 51665

Making sql injection vulnerable code (for testing purposes):

In order to test SQL Injection with your code we need to make some few changes:

<?php

  $connection = mysqli_connect('localhost', 'root','' ,'DB') or 
                die(mysqli_error($connection));  //1
  mysqli_select_db($connection ,'DB') or die(mysqli_error($connection)); //2
  $unsafe_variable = $_POST['vorname'];
  mysqli_multi_query($connection,    //3
               "INSERT INTO `Persons` (`Vorname`) VALUES ('$unsafe_variable')");

?>
  • //1 and //2: mysqli_error needs $connection parameter.
  • //3: Only mysqli_multi_query is able to execute more than one sentence at a time. For security reasons. mysqli_query just executes one to prevent sql injection.

Testing:

It's the time to test sql injection. We create a simple table t to check if we can drop it through sql injection:

create table t ( i int );

Time to attack, the killer string to inject sql is:

pepe'); DROP TABLE t;--

enter image description here

SQL with injected code:

"INSERT INTO Persons (Vorname) VALUES ('pepe'); DROP TABLE t;--')"

Explained:

  • SQL pattern is: "INSERT INTO Persons (Vorname) VALUES ('$unsafe_variable')"
  • "pepe');" replaces $unsafe_variable : "INSERT INTO Persons (Vorname) VALUES ('pepe'); DROP TABLE t;--')"
  • Remember -- means "comments from here", then the last quote and parenthesis is a comment.

After post this value to form:

mysql> select * from t;
ERROR 1146 (42S02): Table 's.t' doesn't exist

How to avoid SQL Injection?

Man, this is Internet, they are a lot of papers about it. Start your searching with Parameterized Queries.

Upvotes: 1

Related Questions