Demonstrating SQL injection attacks to my boss

Question

So I have a project with work to try and teach my boss to start using prepared SQL statements, but he could care less and says it's not a big deal. I want to know how to prove to him it is a big deal, but I just can't figure out how to inject a drop table command on the development test server we have set up. I developed an application for a company that is in its testing phase and I want to take it down (have back up) to present to him the issue, as I am using his SQL code. I am trying to get the company to get in habit of using prepared statements, but I seem to be the only one wanting change and they don't. Can someone help me "crack" this database with SQL injection? Thanks!!

There is a comment box on the form to be submitted and when it sees an apostrophe it throws the error:

Unable to Make Query:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's";', '100', '100')' at line 78

I've tried

foo'); DROP TABLE cabletypes;--

but gives same error. How can I make it inject successfully when I am typing in the textarea prior to form submission? The textarea submits to the 'comments' column and value.

SQL

$sql="INSERT INTO cabletypes
        (cable_type,
        sample_no,
        sample_date,
        section_lg,
        wet_dry,
        avgofppf,
        sheath_type,
        plastic_wt,
        inner_sheath,
        inner_al_wt,
        inner_steel_wt,
        cable_guard,
        guard_al_wt,
        guard_steel_wt,
        guard_other_wt,
        total_pairs_a,
        pair_count_gauge_a,
        copper_wt_a,
        total_pairs_b,
        pair_count_gauge_b,
        copper_wt_b,
        total_pairs_c,
        pair_count_gauge_c,
        copper_wt_c,
        total_pairs_d,
        pair_count_gauge_d,
        copper_wt_d,
        sum_pairs,
        copper_wt,
        copper_percent,
        lead_wt,
        lead_percent,
        contains_lead,
        waste_wt,
        sampler,
        supervisor,
        comments,
        cable_no,
        section_no)
        VALUES (
        '$cable_type',
        '$sample_no',
        '$sample_date',
        '$section_lg',
        '$wet_dry',
        '$avgofppf',
        '$sheath_type',
        '$plastic_wt',
        '$inner_sheath',
        '$inner_al_wt',
        '$inner_steel_wt',
        '$cable_guard',
        '$guard_al_wt',
        '$guard_steel_wt',
        '$guard_other_wt',
        '$total_pairs_a',
        '$pair_count_gauge_a',
        '$copper_wt_a',
        '$total_pairs_b',
        '$pair_count_gauge_b',
        '$copper_wt_b',
        '$total_pairs_c',
        '$pair_count_gauge_c',
        '$copper_wt_c',
        '$total_pairs_d',
        '$pair_count_gauge_d',
        '$copper_wt_d',
        '$sum_pairs',
        '$copper_wt',
        '$copper_percent',
        '$lead_wt',
        '$lead_percent',
         0,
        '$waste_wt',
        '$sampler',
        '$supervisor',
        '$comments',
        '$cable_no',
        '$section_no')";
    }

mysql_query($sql) or die ("Unable to Make Query:" . mysql_error());

print("Sample Sheet Submitted Successfully!");

this talks about sql injection and prevention: http://stackoverflow.com/questions/60174/how-to-prevent-sql-injection-in-php — John Woo, May 02 '13 at 03:03
yeh I read that, but I can't seem to inject anything that that topic says I should be able to with my "vulnerable" code. Maybe SQL injection is not all that serious? I can't seem to crack into the database. Just was wondering if someone could give me a crack to actually drop a table so I can show my boss that it CAN happen. THEN I will have us move to using prepared statements, which he doesn't really understand. — jflay, May 02 '13 at 03:04
Did the DBA do the smart thing and give minimal permissions on the database to your application user? If he gave only the DBA the privilege `GRANT DROP ON cabletypes`, then you won't be able to mess with that table. — Eric Jablow, May 02 '13 at 03:10
Trying to persuade your boss to stop doing something the wrong way when suggested by a subordinate is a political minefield though. Good luck with that. — Matthew Lock, May 02 '13 at 03:34

score 3 · Answer 1 · edited May 23 '17 at 11:43

3

Send him the old story of Exploits of a Mom:

enter image description here

There's a nice example of numerous MySQL injection attacks here: http://www.rackspace.com/knowledge_center/article/sql-injection-in-mysql

(Modern?) PHP prevents multiple statements being issued qith mysql_query, which helps stop some types of SQL injection: https://stackoverflow.com/a/10663100/74585

The old book CGI Programming with Perl, 2nd Edition is worth a read, even if you don't use CGI or perl, as its security chapter brilliantly demonstrates that the essence of avoiding things like SQL injection attacks is to never trust input from the user.

edited May 23 '17 at 11:43

Community

1
1

answered May 02 '13 at 03:04

Matthew Lock

13,144
12
92
130

yeh I've seen all this, just trying to get a hacker to show me how to hack my own site to prove a point :) – jflay May 02 '13 at 03:07
@jflay well, this is not the site you are looking for – John Woo May 02 '13 at 03:08

Bill Karwin · Accepted Answer · 2013-05-02T03:57:56.543

You can't issue multi-query SQL in PHP's ext/mysql interface. So you can't do the ; DROP TABLE Students trick at all. This one of the few points in favor of the deprecated mysql extension.

Ironically, PDO supports multi-query by default for all queries. And Mysqli supports it only if you explicitly call mysqli::multi_query().

But DROP TABLE is not the only illicit thing an attacker may try to do with SQL injection. In fact, an attack that does DROP TABLE is malicious, but gains the attacker nothing of value. Most SQL injection attacks are more methodical.

I can think of an exploit for your example INSERT statement:

http://yourapp.example.com/cable_types.php?supervisor=jflay',(SELECT GROUP_CONCAT(CONCAT(table_name,'.',column_name)) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_schema=DATABASE()), NULL, NULL) --

Voilà! I have just created a cable type whose comment tells me all the tables and columns in your database. I can then use this knowledge in subsequent attempts to exploit other pages in your site.

(Actually, this may not be a sure example, because GROUP_CONCAT has a length limit of 1024 characters by default, and your full set of columns is probably longer than that. You can use this exploit to get the same information but perhaps it'll take several INSERT queries.)

Anyway, your boss really should use parameterized queries for the sake of security, and also for the sake of supporting strings containing apostrophes, but also ease of coding and for performance. Tell him that prepared statements perform 14% faster than non-prepared statements.

Even without using a select that returns privileged data, an attacker can inject text that leads to a DOS attack. He can inject a SELECT that does a Cartesian product on a group of tables and will return indefinitely many records. — Eric Jablow, May 02 '13 at 04:28
@EricJablow, yes, information_schema tables can be used for that kind of DoS, because all users have privileges to read them. — Bill Karwin, May 02 '13 at 09:42
Also, is there a preference between using mysqli_connect() versus a require() accessdb and config db and then calling the connect function using an ini file to connect to DB? — jflay, May 03 '13 at 15:25
Sounds like this is a separate question from your original one, because there's no difference with respect to risk of SQL injection. — Bill Karwin, May 03 '13 at 15:58
Great. That's all I was asking I guess. I will create a new topic, I am learning alot, just have alot of questions and I seem to be the only one at work who is actually looking into this. — jflay, May 03 '13 at 17:36

score 1 · Answer 3 · answered May 02 '13 at 03:04

1

If you store your customers in a database, try using Tom O'Brian as a customer name, and watch the insert statement fail. Then explain that he's losing business because of it.

answered May 02 '13 at 03:04

Eric Jablow

7,874
2
22
29

You'll find that money is a great motivator. And, if the boss tells the operators to leave the apostrophe out, the customer will likely be annoyed when he gets an invoice with his name misspelled. – Eric Jablow May 02 '13 at 03:13
O'Brians are well known to be excellent customers! You don't want to drive them away. :-) – Bill Karwin May 02 '13 at 03:52

Demonstrating SQL injection attacks to my boss

3 Answers3

Linked