Drupal 7.31 pre Auth SQL Injection Vulnerability | Lobsters

2

Drupal 7.31 pre Auth SQL Injection Vulnerability php security sektioneins.de
via jcs 3 years ago | cached | 2 comments

2

1
tedu 3 years ago | link
This is a weakness in most SQL APIs. You can’t effectively bind an array to a variable.
```
int array[4];
Sqlite3_prepare("select name from users where userid in ($)");
Sqlite3_bind_array(stmt, array, 4);
```
Really wish I could something like that, instead of exploding out the string by hand.
1. 1
  jcs edited 3 years ago | link
  It looks like this particular problem is that they are using placeholder names (why?) and the name can get controlled by the user. Using traditional ? placeholders, I don’t get how you can do SQL injection with something like:
  
  user_ids = [ 1, 2, 3, 4 ] execute("SELECT name FROM users WHERE user_id IN (" + user_ids.map{|u| "?" }.join(",") + ")", user_ids)
  
  I think in the worst case if user_ids is some multi-dimensional array, you’ll get a SQL error when the number of placeholders don’t match the number of variables, but you’re still not executing any parts of the statement that the user can alter.