0

If an SQL Injection on the address bar (like ?ID=1) affects two tables (SELECT *FROM catalogue WHERE... and SELECT *FROM reviews WHERE...) with a different amount of columns, how could a hacker inject their SQL (edit: i.e. see all tables)? For example, 'UNIONing' a value from dual to the queried result.

Table 1 (?ID=[row]):

mp3s || COL1 | COL2 | COL3  ... COL5    <-- 5 columns
-----++------+------+------
-----++------+------+------
mp31 || ...  | ...  | ...
-----++------+------+------  
mp32 || ...  | ...  | ...
  :
  '
mp39

Table 2 (?ID=[row]):

revs || COL1 | COL2 | COL3  ... COL19   <-- 19 columns
-----++------+------+------
-----++------+------+------
r001 || ...  | ...  | ...
-----++------+------+------  
r002 || ...  | ...  | ...
  :
  '
r185
0

If it is truly being used for two queries and those queries are selecting a different number of columns there is no UNION SQL Injection attack that will work for both. It's not possible to select two different number of columns at once.

It may be possible to perform other types of SQL Injection attacks like:

ID=1 OR 1=1

but you will need to experiment to see if that is possible in your particular situation.

|improve this answer|||||
  • Those last ones work, but I can't get in. – Duncan Whyte Aug 18 '17 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.