05
SQL Injection 2
No commentsRecently one of the most famous job portals in Romania has been hacked because of unsecured SQL queries. This is because the programmer did not filter the ID from the url (GET method).
He probably wrote something like this :
<?php
//code…
$id = mysql_escape_string($_GET['id']);
$sql = “select * from some_table where id=$id”;
//execute query
//code
?>
As i’ve wrote in the first SQL Injection article this is a common mistake and a very big vulnerability.
My input could be :
www.somesite.com/index.php?id=33 UNION SELECT CHAR(60, 63, 112, 104, 112, 32, 47, 42, 32, 115,111, 109, 101, 32, 112, 104, 112, 32, 99,111, 100, 101, 32, 42, 47, 32, 63, 62) INTO OUTFILE ‘/full/path/to/file.php’
This code writes “<?php /* some php code */ ?>” into the file file.php wich can be executed. Imagine what we could do (delete/copy/modify/add any file/database, send spam, phishing) if we can plant an php file in the website’s root.
There are many examples but I think you’ve got the idea that something that seems to be of little importance can be very harmful.
I hope this article will open your eyes and you will stop making some stupid mistakes. This is not written for illegal purposes.
Have fun coding!
