the-web-application-hackers-handbook

314 Chapter 9 n Attacking Data Stores
So far, so good. However, suppose that the application also implements a
password change function. This function is reachable only by authenticated
users, but for extra protection, the application requires users to submit their
old password. It then verifies that this is correct by retrieving the user’s current
password from the database and comparing the two strings. To do this, it
first retrieves the user’s username from the database and then constructs the
following query:
SELECT password FROM users WHERE username = ‘foo’’
Because the username stored in the database is the literal string foo’, this
is the value that the database returns when this value is queried. The doubledup
escape sequence is used only at the point where strings are passed into the
database. Therefore, when the application reuses this string and embeds it into
a second query, a SQL injection flaw arises, and the user’s original bad input is
embedded directly into the query. When the user attempts to change the password,
the application returns the following message, which reveals the flaw:
Unclosed quotation mark before the character string ‘foo
To exploit this vulnerability, an attacker can simply register a username
containing his crafted input, and then attempt to change his password. For
example, if the following username is registered:
‘ or 1 in (select password from users where username=’admin’)--
the registration step itself will be handled securely. When the attacker tries to
change his password, his injected query will be executed, resulting in the following
message, which discloses the admin user’s password:
Microsoft OLE DB Provider for ODBC Drivers error ‘80040e07’
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting
the varchar value ‘fme69’ to a column of data type int.
The attacker has successfully bypassed the input validation that was designed
to block SQL injection attacks. Now he has a way to execute arbitrary queries
within the database and retrieve the results.
TRY IT!
http://mdsec.net/addressbook/107/
Advanced Exploitation
All the attacks described so far have had a ready means of retrieving any useful
data that was extracted from the database, such as by performing a UNION
attack or returning data in an error message. As awareness of SQL injection