The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

248

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 248

---

which will create an account with 

ID

of 9999 and 

privs

of 0. Assuming that the

privs

field is used to determine account privileges, this may enable the

attacker to create an administrative user. 

In some situations, when working completely blind, injecting into an 

INSERT

statement may enable an attacker to extract string data from the application.

For example, the attacker could grab the version string of the database and

insert this into a field within his own user profile, which can be displayed back

to their browser in the normal way.