MySQL INSERT

Context

This article focuses on the exploitation of MySQL INSERT statements for SQL injection attacks. This type of attack allows a malicious actor to manipulate database operations by injecting unauthorized SQL commands into an application’s database query. To effectively grasp the techniques described, readers should possess intermediate knowledge of SQL syntax, database operations, and HTTP requests. Understanding how other SQL injection techniques work, such as UNION-based, error-based, blind SQL injection, and time-based attacks, is also advantageous.

Theory

MySQL INSERT Statement Vulnerabilities

The MySQL INSERT statement is designed to add new records to a table within a database. However, when applications do not properly validate user inputs, these INSERT statements can become vulnerable to SQL injection attacks. This vulnerability is exploited by crafting payloads that manipulate the insertion of data or by executing additional, unauthorized SQL commands. When an application constructs an INSERT query using unsanitized user input, an attacker can insert malicious SQL fragments that the application will execute.

ON DUPLICATE KEY Clause

The ON DUPLICATE KEY clause in MySQL is intended to update records when an attempted insert results in a duplicate key error. While this feature is useful for legitimate operations, it can be exploited by attackers to alter existing database records or escalate their privileges within an application. For instance, injecting into an INSERT query with the ON DUPLICATE KEY clause allows an attacker to modify user roles or reconfigure data according to their needs.

Admin Takeover via INSERT Injection

A significant risk associated with vulnerable INSERT statements is the possibility of an admin takeover. By injecting payloads that modify user roles or add administrative accounts, hackers can obtain unauthorized access to an application. This type of attack leverages SQL injection to gain administrative privileges, effectively compromising the application's security model. Once administrative access is gained, the attacker has full control over the application and its data.

Practice

Exploiting MySQL INSERT for SQL Injection

Initiating an SQL injection attack via MySQL INSERT statements demands careful identification of vulnerabilities and crafted payloads.

• Identify Vulnerable INSERT Statement Endpoints: Look for points in the application where user input is included directly in an SQL INSERT statement, such as user registration or profile update features.

• Initial Data Submission:

  curl -X POST -d 'username=attacker&password=pass' http://target.com/register
  

  This command simulates a user registration submission, a common point of vulnerability.

• Craft a Malicious Payload:

  username=admin', role='admin' ON DUPLICATE KEY UPDATE role='admin'; --
  

  The payload is designed to insert a new user with administrative privileges or, if a user already exists, to escalate their role to admin by leveraging the ON DUPLICATE KEY clause.

• Execute the Payload:

  curl -X POST -d 'username=admin', role='admin' ON DUPLICATE KEY UPDATE role='admin'; -- ' http://target.com/register
  

  Using this command, the payload is sent to the application endpoint, potentially creating or modifying a user record with administrative privileges.

Result: Successful exploitation allows the attacker to gain administrative privileges by injecting into INSERT statements that modify roles or create new accounts with elevated access rights.

Tools

• sqlmap: An automated tool that detects and exploits SQL injection vulnerabilities.
• Burp Suite: A comprehensive platform for web application security testing, useful for identifying injection points and testing payloads.