Web Penetration Testing with Kali Linux - Third Edition

Vulnerable code

Similar to the command injection flaw discussed earlier, the variable passed using the GET method is also often used to build a SQL statement. For example, the /books.php?userinput=1 URL will display information about the first book.

In the following PHP code, the input provided by the user via the GET method is directly added to the SQL statement. The MySQL_query() function will send the SQL query to the database and the MySQL_fetch_assoc() function will fetch the data in an array format from the database:

<?php 
    $stockID = $_GET["userinput"]; 
    $SQL= "SELECT * FROM books WHERE ID=" . $stockID; 
    $result= MySQL_query($SQL); 
    $row = MySQL_fetch_assoc($result); 
?> 

Without proper input validation, the attacker can take control over ...