[Dong]

I'm not sure how many people are aware of the topic I'm going to discuss, but I figured it's still pretty informative. I actually just exploited this flaw a couple of days ago, so it seems that some people are still making this mistake.

MySQL St00f
According to the MySQL doc:

Inserting a string into a string column (CHAR, VARCHAR, TEXT, or BLOB) that exceeds the column's maximum length. The value is truncated to the column's maximum length.

The issue here is that some programmers, who aren't very experienced in MySQL, tend to depend upon this functionality as a substitute for validating the length of input data.

According to the MySQL doc:

All MySQL collations are of type PADSPACE. This means that all CHAR, VARCHAR, and TEXT values in MySQL are compared without regard to any trailing spaces. “Comparison” in this context does not include the LIKE pattern-matching operator, for which trailing spaces are significant.

Hopefully, you can see where this is going...

Code:

CREATE TABLE test_tbl (test_col CHAR(20)); INSERT INTO test_tbl VALUES ('squad'); INSERT INTO test_tbl VALUES ('squad '); INSERT INTO test_tbl VALUES ('squad '); SELECT * FROM test_tbl WHERE test_col = 'squad'; SELECT * FROM test_tbl WHERE test_col = 'squad ';

The SELECT queries above will both return all 3 of the rows that were inserted.

Example
So, how can this be exploited? Let's imagine that we have a registration form for a webpage. A user will be required to input his desired username and password in order to register. If this username is taken, the user's registration will be rejected. Otherwise, the information will be inserted into the database. Also, we're going to assume that an admin user ("admin") already exists.

Example table:

Code:

CREATE TABLE user ( username VARCHAR(15) , password CHAR(60) );

Now, I'm going to attempt to register as "admin"...

Example of checking whether a username has been registered or not:

Code:

SELECT * FROM user WHERE username = 'admin'

This will return a single row which indicates that this username is already taken. My registration will therefore be rejected.

But what if I tried to register as "admin" + 10 spaces + "a"?

Code:

SELECT * FROM user WHERE username = 'admin a'

0 rows returned. This makes sense since there is no user called "admin a". Now, the application will attempt to INSERT my new user into the database.

Code:

INSERT INTO user VALUES ('admin a', 'paSSwERD');

Remember that the value will be truncated to the column's max length before it's actually inserted. According to the MySQL doc, this means that the user "admin " will be inserted.

VARCHAR values are not padded when they are stored. Trailing spaces are retained when values are stored and retrieved, in conformance with standard SQL.

Let's try logging in now as "admin" with our password.

Code:

SELECT * FROM user WHERE username = 'admin' AND password = 'paSSwERD'

Because this comparison will take place without any regard to trailing spaces, the row containing our user "admin " will be returned. Thus, the application will grant us access.

Conclusion

• If you're going to test this on your end, ensure that you haven't got Strict SQL Mode enabled.
  
• Also don't forget to enable leet dongs mode for ultim8 -2day hacks..................
  

[Oni]

Discussed this with you the other day.

[Skullmeat]

This reminds me of a file shareing exploit in older versions of windows. In order to gain access, you simply had to input the first byte of a password. Ooops.

[meow]

It's too bad this wouldn't work with websites that don't allow spaces in their usernames. This attack reminds me of the path truncation LFI technique that you can use when null byte injection isn't an option.

Also, if the web devs were smart, they would have a filter that wouldn't allow usernames longer than the column length.

[Dong]

It's too bad this wouldn't work with websites that don't allow spaces in their usernames. This attack reminds me of the path truncation LFI technique that you can use when null byte injection isn't an option.

Also, if the web devs were smart, they would have a filter that wouldn't allow usernames longer than the column length.

Yeah, input length should definitely be validated. I've actually seen a dev use PHP trim() in an attempt to patch this up... which obviously doesn't fix it at all. I suppose it's just an inexperience thing. Everyone makes mistakes, I guess.

[Wildfire]

As a PHP dev, I always always always strlen() and, when the time is right, alphanumeric filter before putting something in the DB. People don't get this, but PDO isn't a magic bullet...bad decisions can lead to bad things. Nice find, by the way.

[whatarethechances]

Reminds me of an old WordPress exploit.