AOH :: HP Unsorted S :: BT-30067.HTM

MS Access SQL injection with backslash escaped input



SQL Injection in MS Access with backslash escaped input
SQL Injection in MS Access with backslash escaped input



Many developers still rely on escaping user's inputs by adding backslashes (like using magic_quotes_gpc or addslashes() in PHP), where it is well known that adding backslash to escape inputs in not sufficient to prevent SQL Injections attacks for many different reasons.=0D
=0D
One of those reasons is that MS Access uses a different method to escape apostrophe (') which is doubling it ('') instead of prefixing it with a backslash (\').=0D
=0D
It's true that injection takes place easily in this case, but leveraging it is not so easy using traditional injection technique. Since an excess slash will corrupt the query structure and causes error (actually "Syntax error (missing operator) in query expression...").=0D
=0D
For example consider this query:=0D
=0D
    SELECT * FROM Users WHERE Username = '$user' AND Password = '$pass'=0D
=0D
If the attacker enters the usual "a' OR 'a'='a" as username and password, the query would be like the following, which causes syntax error:=0D
=0D
    SELECT * FROM Users WHERE Username = 'a\' OR \'a\'=\'a' AND Password = 'a\' OR \'a\'=\'a'=0D
=0D
The reason is the query has excess slashes. But (un)fortunately backslash (\) in MS Access is integer divide operator, and this property can be used to make the query valid.=0D
=0D
If the attacker enters "a' OR 5=10'2" as username and password, after prefixing it with backslash, it would be "a\' OR 5=10\'2" which make the query like the following which is valid this time:=0D
=0D
    SELECT * FROM Users WHERE Username = 'a\' OR 5=10\'2' AND Password = 'a\' OR 5=10\'2'

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.