If an SQL Injection on the address bar (like ?ID=1
) affects two tables (SELECT *FROM catalogue WHERE...
and SELECT *FROM reviews WHERE...
) with a different amount of columns, how could a hacker inject their SQL (edit: i.e. see all tables)? For example, 'UNION
ing' a value from dual
to the queried result.
Table 1 (?ID=[row]
):
mp3s || COL1 | COL2 | COL3 ... COL5 <-- 5 columns
-----++------+------+------
-----++------+------+------
mp31 || ... | ... | ...
-----++------+------+------
mp32 || ... | ... | ...
:
'
mp39
Table 2 (?ID=[row]
):
revs || COL1 | COL2 | COL3 ... COL19 <-- 19 columns
-----++------+------+------
-----++------+------+------
r001 || ... | ... | ...
-----++------+------+------
r002 || ... | ... | ...
:
'
r185