the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 313
Exploiting Defective Filters
Input validation routines often contain logic flaws that you can exploit to smuggle
blocked input past the filter. These attacks often exploit the ordering of multiple
validation steps, or the failure to apply sanitization logic recursively. Some
attacks of this kind are described in Chapter 11.
TRY IT!
http://mdsec.net/addressbook/67/
Second-Order SQL Injection
A particularly interesting type of filter bypass arises in connection with secondorder
SQL injection. Many applications handle data safely when it is first inserted
into the database. Once data is stored in the database, it may later be processed
in unsafe ways, either by the application itself or by other back-end processes.
Many of these are not of the same quality as the primary Internet-facing application
but have high-privileged database accounts.
In some applications, input from the user is validated on arrival by escaping
a single quote. In the original book search example, this approach appears to
be effective. When the user enters the search term O’Reilly, the application
makes the following query:
SELECT author,title,year FROM books WHERE publisher = ‘O’’Reilly’
Here, the single quotation mark supplied by the user has been converted into
two single quotation marks. Therefore, the item passed to the database has the
same literal significance as the original expression the user entered.
One problem with the doubling-up approach arises in more complex situations
where the same item of data passes through several SQL queries, being
written to the database and then read back more than once. This is one example
of the shortcomings of simple input validation as opposed to boundary validation,
as described in Chapter 2.
Recall the application that allowed users to self-register and contained a SQL
injection flaw in an INSERT statement. Suppose that developers attempt to fix
the vulnerability by doubling up any single quotation marks that appear within
user data. Attempting to register the username foo’ results in the following
query, which causes no problems for the database:
INSERT INTO users (username, password, ID, privs) VALUES (‘foo’’’,
‘secret’, 2248, 1)