A hacker can exploit my module made by a freelancer, i’m trying to fix the module…
I’m trying to fix the module with the code without escaping sql injection the code like that:
If i use pSQL function or bqSQL function, their is not escaping value for sql injection.
Their is the code of insecure statement
$sql = 'SELECT * FROM `'._DB_PREFIX_.'module_name` where active = 1 and id_customer = '.bqSQL($id_customer). ' and id_shop = '.$id_shop;
$rows = Db::getInstance()->executeS($sql);
if(!empty($rows)){
$row1 = array();
$sql1 = 'SELECT * FROM `'._DB_PREFIX_.'module_name` where active = 1 and number = "'.bqSQL($rows[0]['number']).'"';
$row1 = Db::getInstance()->executeS($sql1);
}
If i insert this text into my module input accessible by client:
jud3v”;INSERT INTO sqlmapoutput (data) VALUES (‘jud3v_digital’);#
The field jud3v_digital will be created on my DB.
Hacker query:
enter image description here
Their is the sql statement made by hacker:
477145 Query SELECT * FROM `ps_magcatreserve_numbers` where number = "941020";INSERT INTO ps_cart_rule ( active, code, description, date_from, date_to, date_add, date_upd, reduction_percent, reduction_currency, reduction_tax, reduction_product, quantity, quantity_per_user, minimum_amount, minimum_amount_currency, minimum_amount_tax, minimum_amount_shipping, free_shipping, highlight, partial_use, priority, shop_restriction, carrier_restriction, cart_rule_restriction, country_restriction, group_restriction, product_restriction, id_customer ) VALUES ( 1, 0x50524f4d4f3939, 0x50726f6d6f74696f6e206465202d3939252073616e73207265737472696374696f6e, NOW(), DATE_ADD(NOW(), INTERVAL 1 YEAR), NOW(), NOW(), 99.00, 1, 1, 0, 1000000, 1000000, 0.00, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0 )#" and id_customer =
477145 Query SELECT * FROM `ps_magcatreserve` where active = 1 and number = "941020";INSERT INTO ps_cart_rule ( active, code, description, date_from, date_to, date_add, date_upd, reduction_percent, reduction_currency, reduction_tax, reduction_product, quantity, quantity_per_user, minimum_amount, minimum_amount_currency, minimum_amount_tax, minimum_amount_shipping, free_shipping, highlight, partial_use, priority, shop_restriction, carrier_restriction, cart_rule_restriction, country_restriction, group_restriction, product_restriction, id_customer ) VALUES ( 1, 0x50524f4d4f3939, 0x50726f6d6f74696f6e206465202d3939252073616e73207265737472696374696f6e, NOW(), DATE_ADD(NOW(), INTERVAL 1 YEAR), NOW(), NOW(), 99.00, 1, 1, 0, 1000000, 1000000, 0.00, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0 )#"
Hacker can update customer matching email address, reset password, access admin panel, delete my whole website (thing done last night with + 170 multi shop), made free order, drop database;
i have now for this time:
- restrict mysql credentials grants (removed DROP grant)
- remove destructive php function
I’m trying to fix the code, but with my test i cannot made a anti sql injection statement, how i can perform this ?
I’m using php 7.1 with presta 1.6.1.24, i have tested too with mysqli prepare statement that do nothing
