I'm currently investigating the latest vulnerability affecting Joomla CMS.
You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is context independent.
The base URL I use to access the vulnerability is:
The injection I use is in the form:
(select col.a Array from (select count(*), concat(0x3a, 0x3a, (select user()), 0x3a, 0x3a, floor(rand()*2)) a from information_schema.columns, jml_users group by a) col) ,'A' union select uc.id
The example above works fine: executing it a few time randomly produces
Subquery returns more than 1 row and the expected
Duplicate entry '::joomla@localhost::0' for key 'group_key' error messages leaking the MySQL user used by Joomla :) !
However, I cannot access all the database content. Some fields will always produce the
Subquery returns more than 1 row and never leak the information they contain.
This limitation is reproducible when connecting directly to a MySQL prompt.
I did not encounter any description of this (quite annoying) limitation in the articles I read on the subject. Is it something known? Is it specific to my MySQL version (5.6.14-enterprise-commercial-advanced)? Is there any workaround?