Re: Is this expoitable via sql injection?

[Nils Gundelach <nils () darktec org>]

Hi,

i can't test your suggestions because he fixed the bug.
Thanks for help! I'll keep that in mind.

Regards,
Nils


Rogan Dawes wrote:
> I'd guess that your query looks something like:
>
> query = 'SELECT * FROM XXX WHERE USERNAME = "' + username + '}$"';
>
> I'm not sure which of the password fields you supplied, but it does not 
> look right in the error message. One field should not have any quotes 
> around it, I think?
>
> Nonetheless, from the first part, we should still be able to inject SQL, 
> using something like:
>
> username = 'foo$"--' // if you want to get access to user foo
>
> I add the '$' into the username, as it appears that the script does so 
> itself. Maybe the database is structured something like:
>
> username$, MD5(Password)
>
> Maybe I'm reading your error message wrong, though.
>
> Regards,
>
> Rogan