SQLi with backslash

[Robin Wood <robin () digininja org>]

Hi
I've got a scenario where both single and double quotes are being
stripped but no other escaping appears to be being performed. The
database is MySQL with php on top.

The query that I've found SQL injection on is in the form

insert into log values ('a', 'b');

where I can inject in to the second parameter.

If I inject a backslash then I get

insert into log values ('a', 'b\');

which gives an invalid SQL statement and is how the injection was
found. Can anyone come up with a way to exploit this? If I put
anything before the slash isn't really worth anything and if I put
anything after then the statement becomes valid and the slash escapes
whatever character is after it.

I thought about using the slash to encode something but couldn't get it to work.

The table is write only for me, I can't see any of its entries echo'ed
back to the site anywhere so I can't go for stored XSS or anything
like that (maybe possible but not in the time available for the test).

Apart from breaking the statement I can't see a way to exploit this,
can anyone else?

Robin



This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now! 
http://www.cenzic.com/2009HClaunch_Securityfocus
--------------------------------------