bugtraq - SQL Injection in MS Access with backslash escaped input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100430101639.15172.qmail@securityfocus.com>
Date: 30 Apr 2010 10:16:39 -0000
From: gheibi@...il.com
To: bugtraq@...urityfocus.com
Subject: SQL Injection in MS Access with backslash escaped input

Many developers still rely on escaping user's inputs by adding backslashes (like using magic_quotes_gpc or addslashes() in PHP), where it is well known that adding backslash to escape inputs in not sufficient to prevent SQL Injections attacks for many different reasons.

One of those reasons is that MS Access uses a different method to escape apostrophe (') which is doubling it ('') instead of prefixing it with a backslash (\').

It's true that injection takes place easily in this case, but leveraging it is not so easy using traditional injection technique. Since an excess slash will corrupt the query structure and causes error (actually "Syntax error (missing operator) in query expression...").

For example consider this query:

    SELECT * FROM Users WHERE Username = '$user' AND Password = '$pass'

If the attacker enters the usual "a' OR 'a'='a" as username and password, the query would be like the following, which causes syntax error:

    SELECT * FROM Users WHERE Username = 'a\' OR \'a\'=\'a' AND Password = 'a\' OR \'a\'=\'a'

The reason is the query has excess slashes. But (un)fortunately backslash (\) in MS Access is integer divide operator, and this property can be used to make the query valid.

If the attacker enters "a' OR 5=10'2" as username and password, after prefixing it with backslash, it would be "a\' OR 5=10\'2" which make the query like the following which is valid this time:

    SELECT * FROM Users WHERE Username = 'a\' OR 5=10\'2' AND Password = 'a\' OR 5=10\'2'