Django Raw Query SQL injection display attack

Question

I am trying to write a website with Django that could display SQL injection for classroom purposes.However when i try to exploit the query nothing is getting returned. I am using a MYSQL database

peopledata = people.objects.raw("select * from people where name = \"%s\" "%input
result = list(peopledata)

I tried using "; show tables; -- and "; --, in the input field and nothing showed up. Is there a way to display the exploited data?

@climbage Thanks. I am getting <RawQuerySet u'select * from people where name ="" and 1=1; --";'>. When i return result i am getting an empty list [] — user1817081
– user1817081, Commented Jun 14, 2013 at 17:09
Still getting the <RawQuerySet> and not returning the data in the table. — user1817081
– user1817081, Commented Jun 14, 2013 at 17:11
Could be that ; isn't allowed in the statement. Try getting rid of that — Mike Park
– Mike Park, Commented Jun 14, 2013 at 17:12

Zzz · Accepted Answer · 2013-06-14 17:34:46Z

0

Your input should be any_name OR'x'='x' or any_name OR name IS NOT NULL

The first input would guarantee the clause to be true no matter what the first clause is.

The second query will then return every record in the database, instead of returning the name you searched for. This is demonstrates a big security risk. If the data being returned is confidential (id SSN) the user has now received access to data he/she should not be viewing.

Another example would be:

any_name; DROP TABLE people; --

And:

any_name; INSERT INTO people('email','passwd','login_id','full_name') 
        VALUES ('[email protected]','hello','steve','Steve LastName'); --

NOTE: Apply these queries appropriately to your DB. Using single/double quotes when necessary etc.

edited Jun 14, 2013 at 17:34

answered Jun 14, 2013 at 17:06

Zzz

3,0655 gold badges41 silver badges59 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Django Raw Query SQL injection display attack

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related