Hello everybody,
I have discovered an SQL Injection in the X-forwarded-for http header, but i got troubles exploiting it, i use the firefox plugin "X-forwarded-for Header" to edit the value and put the quote.
Actually i should double quote to see the error message using : '",
this is the error message i get :
I tried replacing the value of the header by : '" OR 1=1 and everything that i had read about sql injection but i failed.
I would appreciate it if anyone help me
Thank you all.
I have discovered an SQL Injection in the X-forwarded-for http header, but i got troubles exploiting it, i use the firefox plugin "X-forwarded-for Header" to edit the value and put the quote.
Actually i should double quote to see the error message using : '",
this is the error message i get :
Code:
[B]Fatal error[/B]: Uncaught exception 'PDOException' with message 'SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '" or 1/*, VALUE_OF_THE_HEADER'' at line 1' in xxx/www/inc/function.php:190 Stack trace: #0 xxx/www/inc/function.php(190): PDOStatement->execute() #1 xxx/www/index.php(56): is_banned() #2 {main} thrown in [B]xxx/www/inc/function.php[/B] on line [B]190[/B]I tried replacing the value of the header by : '" OR 1=1 and everything that i had read about sql injection but i failed.
I would appreciate it if anyone help me
Thank you all.
