Union-Based injection is an attack method in which an attacker takes advantage of the application not filtering user input correctly, inserting UNION SELECT statements through injection points to merge query result sets to obtain sensitive data. 1. The principle is to use the UNION operator to combine multiple SELECT query results; 2. Attack examples, inject UNION SELECT username, password FROM users into URL parameters; 3. To determine whether the injection point needs to detect the number of columns, ORDER BY or NULL tests are commonly used; 4. Database names, user information, etc. can be extracted in actual combat; 5. Defense methods include using parameterized query, filtering input, the principle of minimum permissions, hiding error information and deploying WAF.

SQL Union-Based injection attacks are a common and effective method in SQL injection, and attackers can use them to extract sensitive information from the database. The core of this attack method is to merge the maliciously constructed query results into the original query results through UNION operator, thereby obtaining additional data.

What is Union-Based Injection?

Simply put, Union-Based injection is the result set of two or more SELECT queries when the application does not correctly filter user input, and the attacker inserts a statement with UNION SELECT through the injection point. If the page displays certain fields in the query results, the attacker can see the part of the data they inject.

For a common example: The URL of a website is like this:

 http://example.com/products.php?id=1

If this page has SQL injection vulnerability and does not filter the parameter id , an attacker may try:

 http://example.com/products.php?id=1 UNION SELECT username, password FROM users

The purpose of this is to "subtitle" the username and password in the users table into the original product information. If the page happens to output fields outside the first query, you can see these sensitive information.

How to determine whether a Union injection point exists?

To utilize Union-Based injection, you first need to confirm whether the target has an injection point of that type. Here are some commonly used judgment methods:

• Column number matching : UNION SELECT requires that the number of columns returned by the first and last two queries are the same. You can use ORDER BY or NULL to detect the number of columns.

  Example:

   http://example.com/products.php?id=1 ORDER BY 5 --

  If the page reports an error, it means that the number of columns may be less than 5; gradually reduce the number until no error is reported.

• Use NULL Test : Use NULL placeholder to test whether each field can be replaced and displayed.

  Example:

   http://example.com/products.php?id=1 UNION SELECT NULL,NULL,NULL --

  If the page displays content normally, you can try to replace it with the real field.

How to extract data in actual combat?

Once the number of columns is determined, you can start trying to extract the data. For example, if you want to view the current database name, user, etc., you can use the following statement:

 http://example.com/products.php?id=1 UNION SELECT database(), user(), version() --

If the page can display these three values, it means you can continue to extract more content, such as the user name and password in the user table:

 http://example.com/products.php?id=1 UNION SELECT username, password, null FROM users --

Note that null here is to match the number of columns in front. Different databases have different structures, so you need to know the table structure of the target database before you can successfully extract it.

How to defend against Union-Based injection?

The key to preventing such attacks lies in strict control and secure handling of user input:

• Use Parameterized Query (Precompiled Statement) : This is the most recommended way to avoid SQL injection completely.
• Filter and validate input : At least special characters must be escaped for cases where spliced SQL must be used.
• The principle of minimum permissions : Do not give unnecessary permissions to database accounts, such as drop, delete, etc.
• Error message processing : Do not expose detailed database error information to front-end users to prevent it from being used for detection.
• Web Application Firewall (WAF) : Deployment of WAF can identify and intercept some typical injection attack behaviors.

Basically that's it. Although Union-Based injection may seem complicated, it is not too difficult to defend as long as you understand its principles and attack process. The key is to pay more attention to input processing during development, so as not to give attackers an opportunity to take advantage of it.

The above is the detailed content of SQL Union-Based Injection Attacks. For more information, please follow other related articles on the PHP Chinese website!