SQL Injection Attacks and Defense - 2009

Advanced Topics • Chapter 7 331
memory. The application then uses an UPDATE statement to write all of the in-memory
items back to the database (see Figure 7.2).
Figure 7.2 The Flow of Information When an Existing Contact Is Updated
1. SELECT
statement
DB
address
2. All quotation
marks doubled up
3. Selected items
updated
name
e-mail
address
4. UPDATE
statement
Let’s assume that the doubling up of quotation marks in this instance is effective in
preventing first-order SQL injection. Nevertheless, the application is still vulnerable to secondorder
attacks. To exploit the vulnerability, you first need to create a contact with your
attack payload in one of the fields. Assuming the database is Microsoft SQL Server, create
a contact with the following name:
a'+@@version+'a
The quotes are doubled up in your input, and the resultant INSERT statement looks like this:
INSERT INTO tblContacts VALUES ('a''+@@version+''a', 'foo@example.org',...
Hence, the contact name is safely stored in the database, with the literal value that you
submitted.
Then, you need to go to the function to update the new contact, and provide a new
value in the address field only (any accepted value will do). When you do this, the application
will first retrieve the existing contact details, using the following statement:
SELECT * FROM tblUsers WHERE contactId = 123
The retrieved details are stored briefly in memory. The value retrieved for the name
field will, of course, be the literal value that you originally submitted, because this is what
was stored in the database. The application replaces the retrieved address in memory with the
new value you supplied, taking care to double up quotation marks. It then performs the
following UPDATE statement to store the new information in the database:
UPDATE tblUsers
SET name='a'+@@version+'a', address='52 Throwley Way',...
WHERE contactId = 123