Forum d'entraide PHPFrance

Bonjour à tous,

Je possede un site de vente en ligne.

J'était en train de maintenir la BDD du site et je me suis rendu dans ma table "pannier" (qui contient pour chaque produit du pannier, l'IP du client / la référence du produit et divers options).

J'ai remarqué que cette table était anormalement trop remplie.

En faisaint quelques recherche, j'ai trouvé 620 enregistrement pour une même adresse IP.

Et, dans la colonne "Réference du produit" des lignes semblabe à une tentative de piratage à mes yeux novices.

Voici quelques exemple :

"DECO-24 or 1=(/**/sElEcT 1 /**/fRoM(/**/sElEcT count(*),/**/cOnCaT((/**/sElEcT(/**/sElEcT /**/uNhEx(/**/hEx(/**/cOnCaT(0x217e21,0x4142433134355a5136324457514146504f4959434644,0x217e21)))) /**/fRoM information_schema./**/tAbLeS /**/lImIt 0,1),floor(rand(0)*2))x /**/fRoM information_schema./**/tAbLeS /**/gRoUp/**/bY x)a) and 1=1"

"999999.9) /**/uNiOn/**/aLl /**/sElEcT 0x393133353134353632312e39,0x393133353134353632322e39,0x393133353134353632332e39,0x393133353134353632342e39,0x393133353134353632352e39,0x393133353134353632362e39,0x393133353134353632372e39,0x393133353134353632382e39,0x393133353134353632392e39,0x39313335313435363231302e39,0x39313335313435363231312e39,0x39313335313435363231322e39,0x39313335313435363231332e39,0x39313335313435363231342e39,0x39313335313435363231352e39,0x39313335313435363231362e39,0x39313335313435363231372e39,0x39313335313435363231382e39,0x39313335313435363231392e39,0x39313335313435363232302e39,0x39313335313435363232312e39,0x39313335313435363232322e39,0x39313335313435363232332e39,0x39313335313435363232342e39,0x39313335313435363232352e39,0x39313335313435363232362e39,0x39313335313435363232372e39,0x39313335313435363232382e39,0x39313335313435363232392e39,0x39313335313435363233302e39,0x39313335313435363233312e39,0x39313335313435363233322e39,0x39313335313435363233332e39,0x39313335313435363233342e39,0x39313335313435363233352e39,0x39313335313435363233362e39,0x39313335313435363233372e39,0x39313335313435363233382e39,0x39313335313435363233392e39,0x39313335313435363234302e39,0x39313335313435363234312e39,0x39313335313435363234322e39,0x39313335313435363234332e39,0x39313335313435363234342e39,0x39313335313435363234352e39,0x39313335313435363234362e39,0x39313335313435363234372e39,0x39313335313435363234382e39,0x39313335313435363234392e39,0x39313335313435363235302e39,0x39313335313435363235312e39,0x39313335313435363235322e39,0x39313335313435363235332e39,0x39313335313435363235342e39,0x39313335313435363235352e39,0x39313335313435363235362e39,0x39313335313435363235372e39,0x39313335313435363235382e39,0x39313335313435363235392e39,0x39313335313435363236302e39,0x39313335313435363236312e39,0x39313335313435363236322e39,0x39313335313435363236332e39,0x39313335313435363236342e39,0x39313335313435363236352e39,0x39313335313435363236362e39,0x39313335313435363236372e39,0x39313335313435363236382e39,0x39313335313435363236392e39,0x39313335313435363237302e39,0x39313335313435363237312e39,0x39313335313435363237322e39,0x39313335313435363237332e39,0x39313335313435363237342e39,0x39313335313435363237352e39,0x39313335313435363237362e39,0x39313335313435363237372e39,0x39313335313435363237382e39,0x39313335313435363237392e39,0x39313335313435363238302e39,0x39313335313435363238312e39,0x39313335313435363238322e39,0x39313335313435363238332e39,0x39313335313435363238342e39,0x39313335313435363238352e39,0x39313335313435363238362e39,0x39313335313435363238372e39,0x39313335313435363238382e39,0x39313335313435363238392e39,0x39313335313435363239302e39,0x39313335313435363239312e39,0x39313335313435363239322e39,0x39313335313435363239332e39 and(0=0"

"999999.9" /**/uNiOn/**/aLl /**/sElEcT 0x393133353134353632312e39,0x393133353134353632322e39,0x393133353134353632332e39,0x393133353134353632342e39,0x393133353134353632352e39,0x393133353134353632362e39,0x393133353134353632372e39,0x393133353134353632382e39,0x393133353134353632392e39,0x39313335313435363231302e39,0x39313335313435363231312e39,0x39313335313435363231322e39,0x39313335313435363231332e39,0x39313335313435363231342e39,0x39313335313435363231352e39,0x39313335313435363231362e39,0x39313335313435363231372e39,0x39313335313435363231382e39,0x39313335313435363231392e39,0x39313335313435363232302e39,0x39313335313435363232312e39,0x39313335313435363232322e39,0x39313335313435363232332e39,0x39313335313435363232342e39,0x39313335313435363232352e39,0x39313335313435363232362e39,0x39313335313435363232372e39,0x39313335313435363232382e39,0x39313335313435363232392e39,0x39313335313435363233302e39,0x39313335313435363233312e39,0x39313335313435363233322e39,0x39313335313435363233332e39,0x39313335313435363233342e39,0x39313335313435363233352e39,0x39313335313435363233362e39,0x39313335313435363233372e39,0x39313335313435363233382e39,0x39313335313435363233392e39,0x39313335313435363234302e39,0x39313335313435363234312e39,0x39313335313435363234322e39,0x39313335313435363234332e39,0x39313335313435363234342e39,0x39313335313435363234352e39,0x39313335313435363234362e39,0x39313335313435363234372e39,0x39313335313435363234382e39,0x39313335313435363234392e39,0x39313335313435363235302e39,0x39313335313435363235312e39,0x39313335313435363235322e39,0x39313335313435363235332e39,0x39313335313435363235342e39,0x39313335313435363235352e39,0x39313335313435363235362e39,0x39313335313435363235372e39,0x39313335313435363235382e39,0x39313335313435363235392e39,0x39313335313435363236302e39,0x39313335313435363236312e39,0x39313335313435363236322e39,0x39313335313435363236332e39,0x39313335313435363236342e39,0x39313335313435363236352e39,0x39313335313435363236362e39,0x39313335313435363236372e39,0x39313335313435363236382e39,0x39313335313435363236392e39,0x39313335313435363237302e39,0x39313335313435363237312e39,0x39313335313435363237322e39,0x39313335313435363237332e39,0x39313335313435363237342e39,0x39313335313435363237352e39,0x39313335313435363237362e39,0x39313335313435363237372e39,0x39313335313435363237382e39 and "0"="0"

une tentative d'injection sql
il faut avoir accès au code pour savoir si les précautions ont été prises pour que cela échoue.

Bonsoir Tof,

De quel code souhaite tu avoir la source ?

le code qui fait une requete sql quand on ajoute un produit au panier; le code qui affiche le contenu du panier, si une requete sql est alors utilisée.

Voici l'URL du fichier contenant les lignes en questions :
http://www.partage-facile.com/I82UA6FGW ... 5.sql.html

Affichage du Pannier :
$sql_Panier = "SELECT * FROM Pannier WHERE ip='$IP'";
$req_Panier = mysql_query($sql_Panier) or die('Erreur SQL !<br />'.$sql.'<br />'.mysql_error());
while ($myrow_Panier = mysql_fetch_array($req_Panier))
{
$Ref = $myrow_Panier["Ref"] ;
$Nombre = $myrow_Panier["Nombre"] ;
...
}

Injection au panier:
Les variables sont des $_GET

$sql = 'INSERT INTO Pannier VALUES("","'.$_SERVER['REMOTE_ADDR']. '", "'.$Ref.'", "'.$Nombre.'", "'.$Taille.'", "'.$Couleur.'", "'.$Couleur2.'", "'.$Prix.'")';
$req = mysql_query($sql) or die ('Erreur SQL !<br />'.$sql.'<br />'.mysql_error());