Database

Re: Is this SQL query about getting information from all forum users' unread PMs?

5-Aug-16 1:04

That's what I'm thinking but, as said, I don't have enough knowledge to make that call.

Richard Deeming1-Aug-16 2:21

Richard Deeming

1-Aug-16 2:21

It looks like somebody is trying to find and exploit a SQL Injection vulnerability in your site:
Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

If the query is actually executing in your database, then you urgently need to review your code to fix the vulnerability. SQLi leaves you vulnerable to a lot worse than information disclosure - it can be used to alter any data in your database, and potentially modify your OS, depending on the configuration.

If it's just appearing in your web logs, and not getting through to the database, then you can probably ignore it.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Re: Is this SQL query about getting information from all forum users' unread PMs?

Eddy Vluggen1-Aug-16 10:55

Eddy Vluggen

1-Aug-16 10:55

Richard Deeming wrote:
It looks like somebody is trying to find and exploit a SQL Injection vulnerability in your site:

I don't see anything in there to escape the current command executed.

You could still be correct, in line with post #2; if the connection-string is exposed, anyone could use that to issue commands. It would be something used to explore the database, which could still be valid use -

More questions; is there a table with that name? Have there been other commands from the same source? Could it have been generated by a tool? (Ever seen what traffic SQLSMS causes?) Smile | :)

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Re: Is this SQL query about getting information from all forum users' unread PMs?

Member 126624485-Aug-16 1:21

Re: Is this SQL query about getting information from all forum users' unread PMs?

5-Aug-16 1:21

There's likely a table with that name given it's a mybb forum, although I see where you're coming from, was it custom created for that purpose? Why would there be a table specifically for unreadpms for all users? I hadn't thought about that.

That thought worries me. They entrusted the SQL side of things to members that I personally did not know the reputation of, and I'm not sure how trustworthy they were (I personally hold the ethos you should only entrust to those you can trust).

All I know is information appears to leak from PM but only recently did I put two and two together (I'm not an admin on the site so it's not something I'd spotted conventionally).

Someone made vague insinuations another forum was dealing with an SQL injection, and that remark always bothered me. But I didn't want to prejudice the first hand analysis.

I think best course of action is to assume worse case scenario, assume there is an injection attempt and find a way to lock it down. If there isn't, site gets extra security and I just look daft, and if there is, everyone benefits.

So next question of course is how do you deal with a site that has presumably been attacked by an SQL injection?

Richard Deeming5-Aug-16 1:56

Richard Deeming

5-Aug-16 1:56

Member 12662448 wrote:
it's a mybb forum

Make sure you've installed the latest version of the forum software. There have been numerous vulnerabilities reported:
Mybb : Security vulnerabilities[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Re: Is this SQL query about getting information from all forum users' unread PMs?

Member 126624485-Aug-16 1:20

Re: Is this SQL query about getting information from all forum users' unread PMs?

5-Aug-16 1:20

Every now and then the forum spews an error specifying the query. It's not in a log, the forum owners are friends and I've done a little bit of SQL for another project but my knowledge is minimal, so when I saw a query asking for unread PMs, it made me suspicious.

The query is verbatim from the error, not correctly formatted I suspect.

They would have no reason to run it, and they aren't SQL savvy enough to construct SQL queries of that nature. So whoever is running it is SQL savvy.

Other forums in our localised community have been hacked, with one fairly recently taken down (the admin's login details were stolen), and we often found information mentioned in PM was somehow 'known' publicly (I conducted experiments between my forum and theirs and found any info in PM on their forum leaked).

I didn't want to preload the dice in my favour by mentioning this, I wanted to see if the query could be an innocent outcome without the prejudicial information to hand.

The fact people are verifying it's asking for all users' unread PMs (as opposed to all PMs in general or a specific users' PMs) verifies my suspicions there's been a database breach.

Do you have any recommendations for securing a database against SQL injections (or maybe some way to test to see if it's vulnerable)?

I don't think extra security could hurt here even if I'm wrong.

Thank you for helping guys, it's all appreciated.

Richard Deeming5-Aug-16 1:53

Richard Deeming

5-Aug-16 1:53

For testing, you can either manually try entering single quotes in various form fields, or use an automated tool like sqlmap[^].

NB: Make sure you have permission from the site owner before testing the site - preferably in writing.

Testing for SQL Injection (OTG-INPVAL-005) - OWASP[^]

To secure the site, you need to modify the code. You'll need to find every place where it issues a SQL query, and make sure it's using parameters. If it's using string concatenation, or string interpolation, or any other means of inserting data directly into the query text, then that's a potential vulnerability.

If your database has any stored procedures that build and execute a dynamic query, you'll also need to update those to use parameters. In Microsoft SQL Server, you would use sp_executesql[^]; other databases probably have something similar.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Re: Is this SQL query about getting information from all forum users' unread PMs?

Member 126624485-Aug-16 9:14

Searching for the right database

5-Aug-16 9:14

Thank you for the help so far.

I'll ask if I have permission to conduct a pentest, then I'll try to setup the software to conduct a check.

Kogs-7927-Jul-16 3:04

27-Jul-16 3:04

Hi there,

as the title already say, I'm searching for the right database for my use case which should work with the following data:

- 2 key/value "tables"
One which holds a string as key and a normal number as value, the second table should hold also a string as key and a string as value.

The first table should hold billions of string/number values, the second one should hold millions of string/string values. So there should be stored a huge amount of data.

The only operations I need to do are the following
- constantly add new entries in both tables
- before adding a new entry, check if the key (string) is already stored
- search for entries which share the same key in both tables. In a relational DB I would execute this statement (select * from tab1, tab2, where tab1.key = tab2.key) -> This search should be as fast as possible.

I'm experienced in any kind of relational DB like oracle, mssql, mysql, postgresql....
As key/value database I only used redis so far.

I think my use case is not good for relational databases. Some NoSQL databases meight be a better choice. Redis is not good as it is an in memory DB with data size limits of the physically memory. As I'm using lot of data I need something else.

Which database would you recommend in my case?

I'm excited to hear your suggestions.

Thank you for your help and have a nice day,
Kogs

Richard MacCutchan27-Jul-16 4:56

Richard MacCutchan

27-Jul-16 4:56

How about SQLite.

Kogs-7927-Jul-16 23:42

27-Jul-16 23:42

Thanks for your suggestion.
I did some research and it looks that SQLite can handle big data very well. So this could work for me.

Nevertheless I think simple key/values store databases meight be faster. But I can also be wrong as I don't have much experience with NoSQL DBs.

User 1106097927-Jul-16 20:33

User 11060979

27-Jul-16 20:33

Quote:
I think my use case is not good for relational databases

Why you are thinking a relational db is wrong here? For me it looks like a rdb fits very good.

For example:

Quote:
before adding a new entry, check if the key (string) is already stored

For this you can define the key as Primary or at least Unique. So, before insert you do not Need to check whether it is allready in. Simply insert, the db will tell you then, whether it was allready in. The Advantages: No multiply checks for unique values(one from you explicit, one from DB while checking constraints) and last but not least, no race condition.

[Edit]
One Thing more, MS SQL with its "Clusterd Index" fits Performance whise perfect for key/value pair.
There is only one Thing: "billions of string/number values" looks like you can not go for the free Version because of restricted db size.

modified 19-Jan-21 21:04pm.

Kogs-7927-Jul-16 23:56

27-Jul-16 23:56

Thanks for your answer.
I just thought that a key/values store meight be a better solution. They are usually designed to be fast with key/values... But I'm not very experienced with NoSQL DBs, so I meight be wrong with this.

If I use a relational db I know how to use PK. For the first table I still need to read it first, because if the key already exists, I also need to update the value of this entry. For the second table it would work just to let the DB check the constraint if the entry already exists or not.

MS SQL is not my first choice, because I also want it to work on Linux systems as well.

Bernhard Hiller27-Jul-16 21:11

Bernhard Hiller

27-Jul-16 21:11

Some points to consider:
- are your keys case-sensitive? In MS SQL, string comparison is normally not case-sensitive, while with postgres or Oracle it is.
- what is the relation ship between the two tables? Do I understand you correctly that there are keys which exist in Table1 only, and other keys which exist in Table2 only?
- do you need some kind of reporting? I.e. how many different keys can be found for a value for keys exiting in both or only one table. Complex aggregation queries work fastest in MS SQL or Oracle, while mysql copes with simple aggregations only (but with two tables, that should still be ok).
- What would you do if a key to be added already exists? Update the record or throw an exception?

Kogs-7927-Jul-16 23:37

27-Jul-16 23:37

Thanks for your reply.
- the keys are all in uppercase in both tables, so a case sensitive match works perfect.
- The first table is the leading data store, the second table is more or less a lookup table. I want to check which entries in the lookup table exists also in the data store table.
- I don't need to search for any values, I need to search only for keys.
- If a key in the first table already exists, I need to update the value (increase the value)
- If a key in the second table already exists, nothing happens, just continue with the next one. But inserting doublicated entries in the secend table are extremly unlikely, so there is no need to check them. It's no problem if for some reason there are really doublicates, to add them twice. But if I use a rdbms and define the key as PK, this check is done automatically.

I will give it a try with a rdbms (not MS SQL because I want it to be available also on Linux systems).
But I'm wondering if a simple NoSQL DB (simple key/value) store meight not be faster in this case. I don't have much experience with NoSQL dbs, but I think they exist for a reason. And I want a really lightning fast solution Wink | ;-)

But if you think a normal sql db can be as fast (or faster) than I give it a try.