Hi Francesco,
Judging from what you wrote, you can do pretty much anything that can be
done by a user (database process) the database server is running as. So
for example if database server is running as administrator (very silly)
then you have admin privelages to the database.
Futhermore, you can try few other less harmful approaches, as an
alternative to your DELETE, evil!!!!
You might want to read the paper called "Blind SQL Injection" (sorry,
dont have the link handy) and try discovering the database scheema as a
hacker would, without any prior knowledge. After that you are set
assuming you are nifty with SQL, sprinkle few UNIONS here and there and
DB is owned, could be even a server ;)
If on the other hand you have access to the database, then login in to
the database SQL console and monitor some table (perhaps a test table
you might want to create before you start) for changes while you issue
an INSERT statment via the web application. This will not only let you
see some imediate results and the risks envolved but could also lead to
"second-order code injection" attacks (http://www.ngssoftware.com) .
Finaly you may also be interested few other articles such as "SQL
Injection Attacks by Example" (again no link, sorry) and "Advanced SQL
Injection In SQL Server Applications" (http://www.ngssoftware.com) , as
well as trying to probe the web app. from the inside, since chances are
security is poor within the account if you could login with 1=1.
Hope this gives you few ideas.
Cheers,
Serg
Francesco wrote:
I have just discovered that I can successfully inject the following SQL:
' OR 1=1; --
into the Username field of a logon form on a "secure" site in my
corporate network (Windows 2000, SQL 7.0). When I do this, leaving the
password field blank, I am logged into the system as the first user in
the "Users" table in the DB which is being authenticated against. LOL.
If I can get that far, can't I theoretically:
' OR 1=1; DELETE Users; --
or something similar? Couldn't I EXEC some system sprocs this way too?
How much damage/rooting can be done here? I need to present a detailed
report to the admins.
Thanks,
Francesco
Francesco Sanfilippo
-------------------------------------------
Blackcoil Productions - http://blackcoil.com
URL123 Link Service - http://url123.com
