New answers tagged


The example you give results in the value 0 (not NULL) being returned. This is because the query you constructed ended up to be a boolean comparison. The = within the assignment part(s) of an UPDATE statement is a comparison operator, not an assignment operator as you might expect. Injection vote`=1, `vote`=10+`vote results in query UPDATE mytable SET /*...


If these were developers working on code you are still running then they could have added backdoors in your code. Having inherited a system in just that state, I know how hard it is to identify the bad code. That you use FTP and cancel does not inspire a lot of confidence in the integrity of your system.


From source code we can see that sqlinjection1 has four known columns username,password,welcomemessage,id. As people pointed in commnets,We can use error based Sql injection to get the usernames,passwords,welcomemessage,id etc. Post below parameters in sqli $user=1' or exp(~(select * from (select concat_ws(':',username,password,welcomemessage,id) from ...


You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the ...

Top 50 recent answers are included