1

I have tried SQL injection with sqlmap using the command below:

sqlmap -u http://localhost/abc.php?id=1 -D datab --sql-shell

Following query works in the SQL shell well:

SELECT * FROM admin

But when I try to drop the table or try to insert into table using SQL queries like DROP TABLE admin or queries like INSERT * INTO admin, following error message is returned:

[WARNING] execution of custom SQL queries is only available when stacked queries are supported
mentallurg
  • 8,536
  • 4
  • 26
  • 41
Shahrukh Khan
  • 119
  • 1
  • 1
  • 4
  • 1
    First off, do you understand what a "stacked query" is? – schroeder Sep 16 '15 at 17:08
  • no i dont understand – Shahrukh Khan Sep 16 '15 at 18:58
  • 1
    Ok, then you need to back up a step. Make sure you do a search when you run into an error in a program, and make sure you understand what it is telling you (99% of the time, the error message will tell you exactly what you need to know). Then for this particular problem, do a search now so that you understand what a "stacked query" is and then come back and edit the question with an update. – schroeder Sep 16 '15 at 19:13

1 Answers1

0

Instead of modifying/continuing the 'current' query with a Boolean-, Error-, Time- or Union-based injection (for example ' OR 1=1 --) which normally makes it possible to only read out all databases, atleast those for which the injection point has permission to.

With a stacked query you append a second (or more) query/queries by putting something like ; [custom query]; -- in the payload (Of course the injection point needs to have permission for altering tables).

In your case, stacked queries are either not supported because you did not test for them or - what is more likely - that the backend simply doesn't support them.

This graphic shows which backend language with which database system supports stacked queries (source). Infographic

UndercoverDog
  • 612
  • 2
  • 17