SQL Injection Attacks and Defense - 2009

50 Chapter 2 • Testing for SQL Injection
ORA-01756: quoted string not properly terminated
System.Web.HttpUnhandledException: Exception of type
'System.Web.HttpUnhandledException' was thrown. --->
System.Data.OleDb.OleDbException: ORA-01756: quoted string not properly
terminated
The PHP function ociparse( ) is used to prepare an Oracle statement for execution. Here
is an example of the error generated by the PHP engine when the function fails:
Warning: ociparse() [function.ociparse]: ORA-01756: quoted string not
properly terminated in /var/www/victim.com/ocitest.php on line 31
If the ociparse( ) function fails and the error is not handled, the application may show
some other errors as a consequence of the first failure. This is an example:
Warning: ociexecute(): supplied argument is not a valid OCI8-Statement
resource in c:\www\victim.com\oracle\index.php on line 31
As you read this book, you will see that sometimes the success of an attack depends on
the information disclosed by the database server. Let’s examine the following error:
java.sql.SQLException: ORA-00907: missing right parenthesis
at oracle.jdbc.dbaccess.DBError.throwSqlException(DBError.java:134) at
oracle.jdbc.ttc7.TTIoer.processError(TTIoer.java:289) at
oracle.jdbc.ttc7.Oall7.receive(Oall7.java:582) at
oracle.jdbc.ttc7.TTC7Protocol.doOall7(TTC7Protocol.java:1986)
The database reports that there is a missing right parenthesis in the SQL statement.
This error can be returned for a number of reasons. A very typical situation of this is
presented when an attacker has some kind of control in a nested SQL statement.
For example:
SELECT field1, field2,
/* Select the first and second fields*/
(SELECT field1 /* Start subquery */
FROM table2
WHERE something = [attacker controlled variable]) /* End subquery */
as field3 /* result from subquery */
FROM table1
The preceding example shows a nested subquery. The main SELECT executes another
SELECT enclosed in parentheses. If the attacker injects something in the second query and
comments out the rest of the SQL statement, Oracle will return a missing right parenthesis error.