There is one task. We have such a request:

SELECT `id`, `name`, `age` FROM `person` WHERE `id` = [мой код тут]

I can add any code from the position of [my code], while the SELECT itself must succeed. That is, it must return one or more than one rows from the person table, while the columns also retain their names.

I did this:

 -1 UNION SELECT 1,2,(SELECT `secret` FROM `table` WHERE `id`=123)

and get a valid exit code:

 SELECT `id`, `name`, `age` FROM `person` WHERE `id` = -1 UNION SELECT 1,2,(SELECT `secret` FROM `table` WHERE `id`=123)

That is, I can read any other table. The question is different: Can I change another / this table? I tried the UPDATE and INSERT constructs, but they do not return anything.

 SELECT `id`, `name`, `age` FROM `person` WHERE `id` = -1 UNION SELECT 1,2,(UPDATE `table` SET `secret`='newval' WHERE `id`=123)

It turns out that the third element is equal to undefined or null (I do not know how correctly in mysql) and at the same time a syntax error is issued. Still, what I need: Run the UPDATE/INSERT within the SELECT command so that the SELECT itself returns something to us at the output - only then the very first SELECT (to which I do not have access) will execute without error.

Maybe someone has some ideas? Thank.

  • select 1 will always return 1 =) ........ why do you put in update instead of set ?) - Alexey Shimansky
  • No, to perform the update here will not work. Sql-injections of this kind work only if the tool through which the query is invoked allows you to actually perform several queries separated by semicolons. then put an arbitrary id semicolon and a separate update request. Only now not many query execution functions support multiple execution - Mike
  • Someone else is program with sql injections? Okay, in the last century, php had no queries with parameters, but now ... - Sergey

1 answer 1

Reply from comments from Mike

No, doing UPDATE will not work here. SQL injections of this kind work only if the tool through which the query is invoked allows you to actually perform several queries separated by semicolons. Then put an arbitrary id semicolon and a separate UPDATE request. Only now, not many query execution functions support the execution of several.