[技術討論] 知唔知SQL Injection 有咩種類?

gronasu

知唔知SQL Injection 有咩種類?
今日去ITSec Security Consulting Limited 面試. 個manager 問.

Mary@2111

你去左?
ok 喎, 佢in 很少人.
佢網站可能有, 你study 下.
https://www.itsec.hk
https://www.itseceu.uk
https://www.sraa.com.hk
https://www.penetrationtest.hk
https://www.itsec.vip

artai

Program 寫果陣, 直接將 text field 的資料送去俾SQL
呢個係program 手段裡面做得唔夠安全的情況

e.g.
login, SQL 原來應該係
SELECT * FROM USER WHERE (USER.user_name ='INPUT_1' AND USER.password ='INPUT_2'

基於SQL ';' 是完成本句SQL 的意思, 如果我在 password 的INPUT_2裡輸入:
xxx'; UPDATE USER (password = '1234') WHERE user_name ='admin'; UPDATE USER (password = '1234') WHERE user_name ='root';

Database 接收到的語句就會係:
SELECT * FROM USER WHERE (USER.user_name ='INPUT_1' AND USER.password ='xxx';
UPDATE USER (password = '1234') WHERE user_name ='admin';
UPDATE USER (password = '1234') WHERE user_name ='root';

這三句SQL, 然後直接執行咗
Program層面, 第一名一定報錯, 所以會彈咗去登入錯誤, 但同時如果系統裡面真係有admin/ root 呢個用戶, 呢個用戶的密碼已經被接中咗及改咗密碼! 呢個網站全部嘢都會俾人控制晒!

rkkc

回覆 3# artai

雙打 https://www.hkepc.com/forum/viewthread.php?fid=26&tid=2739659

artai

回覆  artai

雙打
rkkc 發表於 2025-2-10 09:46

唉...
原來係咁, 唔該C兄
(一班消費壇友的善心的人)