SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 149
The potential of this operator in an SQL injection attack is evident: If the application
returns all the data returned by the first (original) query, by injecting a UNION followed
by another arbitrary query you can read any table to which the database user has access.
Sounds easy, doesn’t it? Well, it is, but there are a few rules to follow, which will be
explained in the following subsections.
Matching Columns
To work properly, the UNION operator needs the following requirements to be satisfied:
■■
■■
The two queries must return exactly the same number of columns.
The data in the corresponding columns of the two SELECT statements must be of
the same (or at least compatible) types.
If these two constraints are not satisfied, the query will fail and an error will be returned.
The exact error message, of course, depends on which DBMS technology is used at the back
end, which can be useful as a fingerprinting tool in case the Web application returns the
whole message to the user. Table 4.4 contains a list of the error messages that some of the
major DBMSs return when a UNION query has the wrong number of columns.
Table 4.4 Inferring the DBMS Version from UNION-based Errors
Database Server
Microsoft SQL Server
MySQL
Oracle
Query
All queries combined using a UNION, INTERSECT
or EXCEPT operator must have an equal number of
expressions in their target lists
The used SELECT statements have a different number
of columns
ORA-01789: query block has incorrect number of
result columns
Because the error messages do not provide any hints regarding the required number of
columns, the only way to derive the correct number is by trial and error. There are two
main methods for finding the exact number of columns. The first consists of injecting the
second query multiple times, gradually increasing the number of columns until the query
executes correctly. On most recent DBMSs (notably not on Oracle 8i or earlier), you can
inject the NULL value for each column, as the NULL value can be converted to any
other data type, therefore avoiding errors caused by different data types in the same
column.