SQL Injection Attacks and Defense - 2009

160 Chapter 4 • Exploiting SQL Injection
simply a ‘500 Internal Server Error’ returned by the Web server, or it might contain the full
SQL Server error message, which will look like the screenshot in Figure 4.8.
Figure 4.8 Error Message As a Result of a Divide-by-Zero
It might also be a generic HTML page that is used to make the application fail
gracefully, but the bottom line is the same: Depending on the value of a specific bit, you can
trigger different responses, and therefore extract the value of the bit itself.
You can easily extend this principle to other types of queries, and for this purpose the
CASE statement is introduced, which is supported by the majority of DBMSs and can be
injected inside an existing query, making it also available when stacked queries cannot be
used. The CASE statement has the following syntax:
CASE WHEN condition THEN action1 ELSE action2 END
As an example, let’s see how we can use a CASE statement to check, in our e-commerce
application, whether the current user is sa:
http://www.victim.com/products.asp?id=12/(case+when+(system_user='sa')+then+
1+else+0+end)