SQL Queries

/* I can inject into the "and (%s)" */
/* I need to avoid breaking the syntax of this query */
SELECT (SELECT COUNT(DISTINCT DETAIL_ID) FROM OBJECTS o LEFT JOIN DETAILS d ON (o.DETAIL_ID = d.ID) WHERE (OBJECT_ID glob '%q$*') AND (%s)) + (SELECT COUNT(*) FROM OBJECTS o LEFT JOIN DETAILS d ON (o.DETAIL_ID = d.ID) WHERE (OBJECT_ID = '%q') AND (%s))

/* in order to inject into this one.*/
SELECT o.OBJECT_ID, o.PARENT_ID, o.REF_ID, o.DETAIL_ID, o.CLASS, d.SIZE, d.TITLE, d.DURATION, d.BITRATE, d.SAMPLERATE, d.ARTIST, d.ALBUM, d.GENRE, d.COMMENT, d.CHANNELS, d.TRACK, d.DATE, d.RESOLUTION, d.THUMBNAIL, d.CREATOR, d.DLNA_PN, d.MIME, d.ALBUM_ART, d.DISC FROM OBJECTS o LEFT JOIN DETAILS d ON (d.ID = o.DETAIL_ID) WHERE OBJECT_ID glob '%q$*' AND (%s) %s %z %s LIMIT %d, %d

/* here's an alternate version of query 2 where the injected string is repeated
 * My string is "Armin", including quotes.
 */
SELECT o.OBJECT_ID, o.PARENT_ID, o.REF_ID, o.DETAIL_ID, o.CLASS, d.SIZE, d.TITLE, d.DURATION, d.BITRATE, d.SAMPLERATE, d.ARTIST, d.ALBUM, d.GENRE, d.COMMENT, d.CHANNELS, d.TRACK, d.DATE, d.RESOLUTION, d.THUMBNAIL, d.CREATOR, d.DLNA_PN, d.MIME, d.ALBUM_ART, d.DISC FROM OBJECTS o LEFT JOIN DETAILS d ON (d.ID = o.DETAIL_ID) WHERE OBJECT_ID glob '1$*' AND (d.ARTIST = "Armin") GROUP BY DETAIL_ID UNION ALL SELECT o.OBJECT_ID, o.PARENT_ID, o.REF_ID, o.DETAIL_ID, o.CLASS, d.SIZE, d.TITLE, d.DURATION, d.BITRATE, d.SAMPLERATE, d.ARTIST, d.ALBUM, d.GENRE, d.COMMENT, d.CHANNELS, d.TRACK, d.DATE, d.RESOLUTION, d.THUMBNAIL, d.CREATOR, d.DLNA_PN, d.MIME, d.ALBUM_ART, d.DISC FROM OBJECTS o LEFT JOIN DETAILS d ON (d.ID = o.DETAIL_ID) WHERE OBJECT_ID = '1' AND (d.ARTIST = "Armin")   LIMIT 1, 1