JobPost SQL Injection: Exploiting a Web Application Vulnerability

What this paper is

This paper, published by Sid3^effects in 2010, describes a SQL injection vulnerability found in the "JobPost" web application. The vulnerability allows an attacker to manipulate database queries by injecting malicious SQL code through the iType parameter in the type.asp script.

Simple technical breakdown

The JobPost application uses a web page (type.asp) that takes a parameter called iType. This parameter is supposed to be used to filter or select job types. However, the application doesn't properly sanitize the input from iType before using it in a SQL query. This means an attacker can insert SQL commands into the iType parameter, which the database will then execute. This can lead to unauthorized access to data, modification of data, or even complete compromise of the database.

Complete code and payload walkthrough

The provided paper snippet is very brief and does not contain any actual code or payload bytes. It only describes the vulnerable URL structure.

• Vulnerable URL Structure:

  http://server/JobPost/type.asp?iType=[ur injection code]

  • http://server/JobPost/type.asp: This is the target script within the JobPost web application.
  • ?iType=: This indicates the start of the query string, and iType is the name of the parameter being passed to the type.asp script.
  • [ur injection code]: This placeholder signifies where an attacker would insert their malicious SQL commands.

Explanation of the vulnerability:

The core issue is that the type.asp script likely constructs a SQL query using the value provided in the iType parameter without proper validation or escaping. A typical vulnerable query might look something like this (this is an assumption as the code is not provided):

SELECT * FROM Jobs WHERE JobType = 'some_default_value' AND iType = '<user_input_from_iType>'

If an attacker provides input like ' OR '1'='1, the query would become:

SELECT * FROM Jobs WHERE JobType = 'some_default_value' AND iType = '' OR '1'='1'

The OR '1'='1' condition is always true, causing the query to return all records from the Jobs table, effectively bypassing intended filtering and revealing all job postings.

Code Fragment/Block -> Practical Purpose:

• http://server/JobPost/type.asp?iType= -> Identifies the vulnerable script and the parameter susceptible to injection.
• [ur injection code] -> Placeholder for attacker-controlled SQL commands.

Shellcode/Payload Segments:

There are no shellcode or payload bytes provided in the original paper. The exploit described is a classic SQL injection, which typically involves manipulating SQL queries to extract or modify data, rather than executing arbitrary code directly on the server through shellcode.

Practical details for offensive operations teams

• Required Access Level: Typically requires unauthenticated access to the web application. The vulnerability is exposed via a public-facing URL.
• Lab Preconditions:
  • A running instance of the JobPost web application (or a similar PHP/ASP web application with a vulnerable type.asp script).
  • A backend database (likely Microsoft Access, as mentioned in the description, though the exploit would apply to other SQL databases).
  • Network access to the target web server.
• Tooling Assumptions:
  • Web browser for manual testing.
  • SQL injection tools like SQLMap, Burp Suite (with its SQL injection scanner), or manual crafting of requests using tools like curl or Postman.
• Execution Pitfalls:
  • Database Type: The exact SQL syntax for injection might vary slightly depending on the backend database (e.g., Access, MySQL, MSSQL). The paper mentions Access, but modern applications might use others.
  • WAF/IDS Evasion: Web Application Firewalls (WAFs) and Intrusion Detection Systems (IDS) might detect common SQL injection patterns. Evasion techniques might be necessary.
  • Application Logic: The effectiveness of the injection depends on how the iType parameter is used within the type.asp script and the underlying SQL query. If the application has strong input validation or parameterized queries, this specific vulnerability might not exist.
  • Error Handling: The application's error handling can reveal information. Verbose error messages might help craft more precise injections.
  • Authentication Bypass: If the iType parameter is used in a context that requires authentication, the injection might be used to bypass login mechanisms or gain access to restricted data.
• Telemetry:
  • Web Server Logs: Increased requests to type.asp with unusual characters or patterns in the iType parameter.
  • Database Logs: Unusual or malformed SQL queries being executed.
  • Application Errors: If the injection causes application errors, these might be logged.
  • Data Exfiltration: If the injection is successful in extracting data, this would be a significant indicator.

Where this was used and when

• Context: This vulnerability was found in the "JobPost" web application, described as suitable for small businesses to manage job openings. The backend is mentioned as an Access database.
• Approximate Years/Dates: The paper was published on April 30, 2010. Therefore, this vulnerability was likely actively exploited or discovered around 2010. Such vulnerabilities in older, unpatched web applications can persist for years.

Defensive lessons for modern teams

• Input Validation and Sanitization: Always validate and sanitize all user-supplied input before using it in database queries. This includes checking for expected data types, lengths, and character sets.
• Parameterized Queries (Prepared Statements): Use parameterized queries or prepared statements. This is the most effective defense against SQL injection, as it separates the SQL code from the user-supplied data. The database engine treats the input strictly as data, not executable code.
• Least Privilege: Ensure the database user account used by the web application has only the necessary permissions. This limits the damage an attacker can do even if they manage to inject SQL.
• Web Application Firewalls (WAFs): Deploy and configure WAFs to detect and block common SQL injection attack patterns. However, WAFs should be a layer of defense, not the sole solution.
• Regular Patching and Updates: Keep all web applications and their underlying frameworks and databases updated with the latest security patches.
• Secure Coding Practices: Train developers on secure coding practices, including the dangers of SQL injection and how to prevent it.
• Error Handling: Configure applications to display generic error messages to users while logging detailed errors internally. Avoid revealing database structure or query details to the end-user.

ASCII visual (if applicable)

This is applicable.

+-----------------+      +---------------------+      +-----------------+
| Attacker's Input| ---> | Web Server (type.asp)| ---> | Database Server |
| (iType parameter)|      | (Vulnerable Script) |      | (JobPost Data)  |
+-----------------+      +----------+----------+      +-----------------+
                                    |
                                    | (Unsanitized SQL Query)
                                    v
                           +-----------------+
                           | Malicious SQL   |
                           | Execution       |
                           +-----------------+

Source references

• Paper ID: 12461
• Paper Title: JobPost - SQL Injection
• Author: Sid3^effects
• Published: 2010-04-30
• Keywords: PHP, webapps
• Paper URL: https://www.exploit-db.com/papers/12461
• Raw URL: https://www.exploit-db.com/raw/12461

Original Exploit-DB Content (Verbatim)

# vendor :http://www.aspsiteware.com/job.asp
# Author:Sid3^effects
# Code :
--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r,41.w4r10r     
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
 
Description :
JobPost is an application ideal for the small or independent business or association who need a way to post and update job openings internally or on the internet. Ideal for intranets Backend by Access database, JobPost can store thousands of job postings in categories.
############################################################################

Xploit : SQLi Vulnerability

       The version of JobPost is vulnerbale

  http://server/JobPost/type.asp?iType=[ur injection code]
 


############################################################################


#Sid3^effects