License plate SQL injection, would it work?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > License plate SQL injection, would it work?

kloa: Feb 14, 2007

I guess it could, depending on how the camera systems works (which I have no idea). I'm guessing the camera's either save a video of you running the light, save a compressed image of you running the light, or if it's really sophisticated, it could look up your license plate on-the-fly.

The first 2 options are probably human verified, so the SQL wouldn't work. It would have to be an automated system.

code:

SELECT *
FROM DMV_MASTER_DATABASE
WHERE LICENSE_PLATE = ?;

If the camera software was as simple as this, then you could throw something like ' OR 1=1; and it wouldn't ever grab your plate.

# ¿ Apr 5, 2014 22:56

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 20:37

kloa: Feb 14, 2007

stuxracer posted:

It would read, but would return every record from the table since 1=1.

Yeah, I probably should've put AND 1=2, which is always false. Then it wouldn't grab it.

# ¿ Apr 30, 2014 16:22

kloa: Feb 14, 2007

Tab8715 posted:

I'm a little sql illiterate but wouldn't it just look for the string "OR 1=2" from the license_plate column in the DMV table?

You can read up on SQL injection on your own time, but the initial ' is to close the license plate WHERE clause early and then attach some kind of extra qualifier (AND 1=2) so that the full statement is false and never queries your license plate.

IE: The camera ticket would be saved normally, but if you attach a false statement, then the whole query brings back 0 results, instead of the speeders information.

# ¿ Apr 30, 2014 19:40

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > License plate SQL injection, would it work?