SQL injection with single statement query

Question

Suppose I had a vulnerable query like this:

var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;';

For the purposes of this question, req.body.id could be any integer parameter that isn't type-checked as everything over HTTP is a string.

Since the MySQL extension disables multi-statement queries by default, I can't do something like:

http://example.net/foo?id=1;INSERT INTO y VALUES (things...);--

Is it possible to execute a data manipulation statement (such as INSERT, UPDATE, DELETE) with this vulnerable query?

Answer 1

Injecting a stack-query statement is only possible if the target application is using the MySQL Multi-Query interface. The vast majority of SQL injection does not permit query stacking. Query stacking is useful, but you can access the database and even pop a shell without it. SQLMap can perform these attacks.

Query stacking is used more commonly in documentation about sql injection than in the real world. This is probably because it is easiest to explain sql injection using a query stacking demonstration.