SQL Injection Modify / Insert Table Values

Question

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case:

1. The only protection in the PHP code is mysql_real_escape_string().
2. The query is constructed in double quotes: "select id from db where id = $id" not single string literal quotes.
3. The database is mysql (using mysql_query php call) so I don't think stacked queries is possible (correct me if I'm wrong).
4. Using mysql not mysqli.

I've tried using something like 1; update users set first_name = foo with no luck and tried passing in commas ' in hex and octal format with no luck: chr(0x27) char(0x27) chr(047) ascii tables.

Is it possible to actually update or insert under these conditions?

Answer 1

Query stacking, ie select * from tbl; update ... -- is forbidden by most database management systems. In order to enable query stacking in PHP/MySQL, the application must use the mysql_mutli_query() function to execute the query. This function is uncommon in the wild.

In SQL injection without query stacking, the attacker is limited by accessible query operators, and SQL functions. The tool SQLMap allows an attacker to access functionality exposed by SQL injection with an easy to use shell. The example sql injection vulnerability provided maybe blind sql injection, which can be exploited with SQLMap.

In MySQL, an attacker can append a union select to access other tables:

select id from db where id = 1 union select password from users

or a sub-select:

select id from db where id = (select password from users)

Additionally an attacker could read file using the load_file() function:

select from db where id = load_file('/etc/passwd')

Only select statements can use the into outfile query operator:

select from db where id = 1 union select password from users into outfile '/var/www/backup.txt'

The into outfile operator requires the use of single-quotes and cannot be used in a SQL injection exploit when mysql_real_escape_string() is used.

The paper Hackproofing MySQL is still relevant, and covers these attacks, and more.

Answer 2

It may be possible using select into SELECT id FROM table1 WHERE id = 1 INTO table2 However as the attacker does not directly control the id value the attacker would need another method of controlling this data for the attack to be able to have a meaningful impact.