SQL Server 与 MySQL - 经典 ASP 中的 SQL 注入漏洞
最近，我们的一个客户网站由于未能清理提供给页面的查询字符串参数而遭受 SQL 注入攻击。易受攻击的代码已经被识别出来并正在被纠正，但这让我想知道 MySQL 和 SQL Server 处理多查询字符串的方式之间的一些差异。
该漏洞代码被用于数十个网站，其中两个网站运行在 SQL Server 上，其余网站运行在 MySQL 上。使用这段代码，我们以前从未遭受过注入攻击（感谢上帝的恩典），但是一旦我们发布了在 SQL Server 上运行的两个网站（具有相同的代码库），该网站很快就被利用了。注入的方法非常简单：
page.asp?param=1;delete from [some_table];
正如我所说，易受攻击的代码在许多网站上共享，但如果我尝试执行相同的代码我们的 MySQL 站点上的注入类型 ASP 会抛出一个很好的服务器错误，让我们知道查询中存在错误：
SELECT * FROM Table1 WHERE ID = 1;DELETE FROM TABLE1;
进一步测试这一点能够验证当 ADODB.Connection 对象调用 Execute("") 时，MySQL ODBC 3.51 驱动程序不允许在同一语句中执行两个 SQL 查询，而 SQL Server Native Client (10.1) 则没有任何问题运行两个并行查询。事实上，这是否只是提供程序的一种配置，使得 SQL Server 容易受到这种方式的攻击，而 MySQL 却不会，还是这源于其他地方？
Recently one of our client's websites fell prey to a SQL Injection attack due to a failure to sanitize query string parameters provided to the page. The vulnerable code has since been identified and is being corrected, but it got me wondering about some of the differences between how MySQL and SQL Server process multi-query strings.
The vulnerable code is used on several dozen websites, two of which are are running on SQL server while the rest are on MySQL. With this code we have never before suffered an injection attack (by the grace of God), but once we released the two websites that are running on SQL server (with the same code base) the website was quickly exploited. The method of injection was quite simple:
page.asp?param=1;delete from [some_table];
Like I said, the vulnerable code is shared across many websites, but if I try to execute the same type of injection on our MySQL sites ASP throws up a nice Server Error letting us know that there was an error in the query:
SELECT * FROM Table1 WHERE ID = 1;DELETE FROM TABLE1;
Testing this further I was able to verify that the MySQL ODBC 3.51 Driver will not allow two SQL queries to be executed in the same statement when an ADODB.Connection object calls Execute(""), while SQL Server Native Client (10.1) doesn't have any problem running two side-by-side queries. Is this in fact just a configuration of the provider that makes SQL server vulnerable in this fashion while MySQL is not, or does this stem from somewhere else?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
默认情况下，MySQL 客户端 API 不允许多重查询。您必须显式启用此功能，否则在尝试执行您所看到的查询时会出现错误。这对于降低 SQL 注入攻击的风险是一件好事。
MySQL ODBC 驱动程序 3.51.18（2007 年 8 月）添加了对连接选项
FLAG_MULTI_STATEMENTS的支持，以启用多语句。请参阅 http://dev.mysql .com/doc/refman/5.1/en/connector-odbc-configuration-connection-parameters.html。另请参阅 http://bugs.mysql.com/bug.php?id=7445< /a> 查看此选项的历史记录。
另请参阅我对“Mysql 更改分隔符以获得更好的 SQL 的回答注入处理？”请注意，多语句只是获得 SQL 注入漏洞的一种方法。禁用多语句并不能 100% 防止这些缺陷。
The MySQL client API does not permit multi-queries by default. You have to enable this explicitly, or else you'll get errors when trying to execute a query like you saw. This is a good thing for reducing risk of SQL injection attacks.
The MySQL ODBC driver 3.51.18 (August 2007) added support for a connect option
FLAG_MULTI_STATEMENTSto enable multi-statements. See http://dev.mysql.com/doc/refman/5.1/en/connector-odbc-configuration-connection-parameters.html.See also http://bugs.mysql.com/bug.php?id=7445 for the history of this option.
Also see my answer to "Mysql change delimiter for better SQL INJECTION handling?" Note that multi-statements is only one way to get an SQL injection vulnerability. Disabling multi-statements is not a 100% proof against these flaws.
SQL Server 的一个特性是它支持一行上的多个语句。解决方案与其说是清理输入，不如说是使用参数化查询或存储过程。如果查询是
然后传递“
1;DELETE FROM TABLE1;”将会产生错误，因为这不是有效的整数值。It's a feature of SQL server that it supports multiple statements on a line. The solution is not so much to sanitize the input, as to use parameterized queries or stored procedures. If the query had been
Then passing "
1;DELETE FROM TABLE1;" would have produced an error, since that's not a valid integer value.我认为发生这种情况是因为 SQL Server 支持 MARS。据我了解MySQL不支持这个。 Mars 是一个很好的功能，可以加快数据库查询速度，从而减少往返次数。你可以在一条sql语句中放置多个查询。
I think this happened because SQL Server supports MARS. As far as I understand MySQL does not support this. Mars is a good feature to speed up database queires so there are fewer round trips. you can put more then one query in a sql statement.
无需堆叠查询即可利用 SQL 注入。一种非常常见的方法是使用“Union Select”
这是我编写的一个 mysql 注入漏洞，它使用 union select：
http://milw0rm.com/exploits/3002
union select 允许您在其他语句中创建 select 语句：
select 1 union select Password from mysql.user
您还可以进行子选择：
插入某个表 (some,col,id) 值 ((从 mysql.user 选择密码),1,1)-- )
盲 SQL 注入适用于所有平台，但是根据数据库的不同，漏洞利用会有所不同。这是针对 mysql 的盲目 SQL 注入漏洞：”
milw0rm.com/exploits/4547
这是一篇关于 MySQL SQL 注入主题的非常好的论文：
www.ngssoftware.com/papers/HackproofingMySQL.pdf
It is possible to exploit SQL injection without stacking queries. A very common method is to use a "Union Select"
Here is a mysql injection exploit that I have written which uses a union select:
http://milw0rm.com/exploits/3002
A union select allows you make a select statement within other statement:
select 1 union select Password from mysql.user
You can also do a sub-select:
insert into sometable (some,col,id) values ((select Password from mysql.user),1,1)-- )
Blind sql injection works on all platforms, however depending on the database the exploit will be different. This is a blind SQL Injection exploit for mysql:"
milw0rm.com/exploits/4547
This is a very good paper on the topic of SQL Injection for MySQL:
www.ngssoftware.com/papers/HackproofingMySQL.pdf