In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database.
We prepared our VM's with PHP with disabled magic quotes to allow this kind of abuse. Otherwise, this would not work. We also have very old version of phpBB from 2005.
SELECT user_id, username, user_password, user_active, user_level,
user_login_tries, user_last_login_try
FROM USERS_TABLE
WHERE username = ’$username’ AND user_password = ’md5($password)’;
We can log into the phpBB site by using this command in login.php username field: admin'#
or admin';--
.
But when I try to insert an additional account to the database by following code I'm not able to add or modify any information in database:
admin';INSERT INTO users_table(user_id,username,user_password)
VALUES('100','user',.md5('pass'))#
Now, why am I NOT able to add/update/delete any accounts? I have a brief idea why, but I'm not 100% sure. I'm not asking how to make it work, but rather why this wouldn't work.