Hacker News Reader

Comment by jcrites | Hacker News Reader

Is there really a SQL injection vulnerability?

Can someone describe the specific vulnerability in more detail? All the example URLs in the article yield an SQL syntax error, which definitely puts the site at high risk for such vulnerabilities. However, on the other hand, I saw no URLs that actually demonstrated successful injection.

For it to be an injection vulnerability, the server needs to execute the query (not fail with a syntax error).

Does anyone have a working example? Nothing malicious please. I tried several basic techniques and was unsuccessful, due to what appears to be escaping on double and single quote characters.

View on HN

Please goto http://sqlmap.org . Watch the video. And weep. If you have really simple sql exception like this, you can craft queries that will dump the entire database including it's schema and users byte-by-byte with an automated script.

SQL Injections are the basis of escalating further and possibly even hacking into the whole underlying system.

I know for a fact that I can dump any of these databases within hours. I do not know what's in them, but I'm guessing it's not information that any of these 100.000 business owners will want to disclose of their clients.

I also know it's illegal, but then agian, will that bother any 13 year old kid that feels himself a 1337 h4xx0r? Any Russian delegation? I think not.

After an hour of playing around (nothing malicious) yes it is vulnerable, a lot of sites use the same DB structure (which is because they were made by the same people) and passwords are stored in plain text.

So No it is not just syntax error.

Would you mind sharing an example query string that injects and passes validation? I'd be interested to see what technique enables it to be valid.

(It's obvious to me that the site is under high risk since user-provided strings show up in SQL validation errors, which includes the rest of a real query, but simple injections like using ' and " to break out did not work in my few minutes of trying, so I'm interested to learn what worked.)

I will send you a generic example on your email.

One problem is that the SQL error messages are being displayed. That is really bad, since being able to read the error messages can be used to systematically find vulnerable queries.

The fix could be as simple as a digits-only regex on page ids and redirects on db exceptions.

Reply on news.ycombinator.com