CODEWITHSUNDEEP
pythonmariadbsql-injection
Tirvax
Tirvax

Reputation: 35

SQL injection MariaDB python CTF

I'm trying to get admin access to an app (ctf). The injection takes place in a login form in the username input. I can bypass the user but not the password (invalid username at first. After my injection, I get invalid password). I have some trouble understanding the python code related, especially the .replace('%', '%%')).

Part of the error message :

if cursor.execute('SELECT password FROM users WHERE name=\'%s\'' % request.form['name'].replace('%', '%%')) == 0:

My payload is : admin' union select 1;--

Do you have any clues?

Upvotes: 2

Views: 5712

Answers (1)

Rick James
Rick James

Reputation: 142518

At least escape backslash, apostrophe, and double quote. For example, turning

admin' union select 1;--

into

admin\' union select 1;--

would have prevented this case of SQL injection.

Upvotes: 3

Related Questions