Re: SQL injection

[Serg Belokamen <sergb () tpg com au>]

Hi Francesco,

Judging from what you wrote, you can do pretty much anything that can be 
done by a user (database process) the database server is running as. So 
for example if database server is running as administrator (very silly) 
then you have admin privelages to the database.

Futhermore, you can try few other less harmful approaches, as an 
alternative to your DELETE, evil!!!!

You might want to read the paper called "Blind SQL Injection" (sorry, 
dont have the link handy) and try discovering the database scheema as a 
hacker would, without any prior knowledge.  After that you are set 
assuming you are nifty with SQL, sprinkle few UNIONS here and there and 
DB is owned, could be even a server ;) 

If on the other hand you have access to the database, then login in to 
the database SQL console and monitor some table (perhaps a test table 
you might want to create before you start) for changes while you issue 
an INSERT statment via the web application. This will not only let you 
see some imediate results and the risks envolved but could also lead to 
"second-order code injection" attacks (http://www.ngssoftware.com) .

Finaly you may also be interested few other articles such as "SQL 
Injection Attacks by Example" (again no link, sorry) and "Advanced SQL 
Injection In SQL Server Applications" (http://www.ngssoftware.com) , as 
well as trying to probe the web app. from the inside, since chances are 
security is poor within the account if you could login with 1=1.

Hope this gives you few ideas.

   Cheers,
       Serg

Francesco wrote:

> I have just discovered that I can successfully inject the following SQL:
>
> ' OR 1=1; --
>
> into the Username field of a logon form on a "secure" site in my
> corporate network (Windows 2000, SQL 7.0).  When I do this, leaving the
> password field blank, I am logged into the system as the first user in
> the "Users" table in the DB which is being authenticated against.  LOL.
>
> If I can get that far, can't I theoretically:
>
> ' OR 1=1; DELETE Users; --
>
> or something similar?  Couldn't I EXEC some system sprocs this way too? 
> How much damage/rooting can be done here?  I need to present a detailed
> report to the admins.
>
> Thanks,
>
> Francesco
> Francesco Sanfilippo
> -------------------------------------------
> Blackcoil Productions - http://blackcoil.com 
> URL123 Link Service - http://url123.com 
>
>
>
>