SQL Injection - Valid subqueries within T-SQL IN - sql-server

Question

I am trying to learn some SQL Injection and wanted to ask if any other query other than select could be executed within a SQL IN Operator.
Normal IN operator syntax is this
select * from tableX where ID IN (select userId from tableY where colX='Y')
I would want to pass in a sql stmt via querystring to delete all users in a table.
Is this possible to do if this injected sql is executed within a IN operator.
This is what I want to achieve
select * from tableX where ID IN (delete tableY)
or
select * from tableX where ID IN (update tableX set ID=100 where 1=1)
or
select * from tableX where ID IN (exec(N'delete tableY'))
I keep getting weird syntax errors. May be this is not as per the sql spec. But in case anyone knows of valid subqueries which might help me achieve the goal, please post.
Edit: Should have also added this.
The system already has couple of defenses.
This value is passed to a SP as a parametrized value.
But one the whole there is one weakness
The only weak point I see which I am trying to exploit is the construction of the sql string in the SP using the passed in value.
set #where = #where + 'ID IN (' + #htmlEncodedParametrizedParam + ')
So all I have to break this code is send in only a pure sql string (no ; or ) which could be used within an IN operator.
Edit2: Coded up to verify #Dan's answer. No avail.
Create procedure HackTest
#qsVal nvarchar(200) = ''
As
Begin
declare #sql as nvarchar(1000)
set #sql = 'select * from AdventureWorks2008.Person.Person' + 'where PersontType IN (' + #qsVal + ')'
exec sp_executesql #sql
end
Below are the request and what MS Sql server profiler captured for these requests
--http://localhost:11727/SampleSite/Default.aspx?a=NULL);delete%20tableY;--
exec hackTest #qsVal='NULL);delete tableY;--'
--http://localhost:11727/SampleSite/Default.aspx?a=NULL);update%20tableX%20set%20ID=100;--
exec hackTest #qsVal='NULL);update tableX set ID=100;--'

Answer 1

No, the IN operator does only allow a subquery or a list of expressions:
test_expression [ NOT ] IN
( subquery | expression [ ,...n ]
)
So you can’t use a DELETE or an UPDATE statement there but only a SELECT statement.
However, since SQL Server support batches, you could simply append your own statement after the SELECT statement:
SELECT … ; DELETE …

Answer 2

you could simulate multiple queries, for example, this is your query, parameter will be replaced later by your program:
SELECT * FROM tableX WHERE ID IN (<somestring>)
if you were to replace with this text:
1); DROP TABLE tableY;--
you'll get executable query like this:
SELECT * FROM tableX WHERE ID IN (1); DROP TABLE tableY;--)

Answer 3

If the application constructs the SQL statement with string concatenation like:
selectQuery = "select * from tableX where ID IN (" + queryString + ")";
This particular SQL injection vulnerability can be exploited by adding "NULL);" followed by the SQL statement to be injected, and then a comment marker. Example query string values:
NULL);delete tableY;--
NULL);update tableX set ID=100;--
Of course, one should never pass a SQL statement via a query string. The best defense against SQL injection is simply to use parameterized queries rather than building statements with string concatenation from untrusted sources.