SQL table column number changes with injection query?

Question

A very basic sql injection question here, I found a SQLi on a mysql website with product.php?id=200.

I first tired ORDER BY to figure out the column number of that table by product.php?id=200 order by 13

which turns out to be 12 columns, the error shows on order by 13 is

Error: SELECT * FROM `category` WHERE is_active='1' AND id =200 order by 13

Unknown column '13' in 'order clause'

Everything looks good, so I tried to figure out the table names next,

product.php?id=200 union select table_name,2,3,4,5,6,7,8,9,10,11,12 from 
information_schema.tables

and it shows

Error: SELECT * FROM `products` WHERE is_active='1' AND id =200 union select 
table_name,2,3,4,5,6,7,8,9,10,11,12 from information_schema.tables

The used SELECT statements have a different number of columns

Regardless how many numbers I put to the select query, it always show the same error, I assume there are some dynamic activities going on in the backend, but I am not sure what, and how should I proceed, any suggestions please? Thank you!

Answer 1

You are injecting into two different queries (one selecting from category, one from products), which select from tables which have a different column count. When you fix one column count, the other one will not match anymore.

You can't at the same time give different column counts - and you likely can't skip one of the queries - , so a simple union injection will not work.

As errors are displayed to you, you can use a simple error-based injection. If errors were not displayed, you could still use timing- and possibly content-based blind injection (see here for examples for all three). In each case, you would likely want to inject into the first query (it depends a bit on how errors are handled).