SQL injection using union statement

Question

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements:

SELECT * FROM login where email = '$_POST';

I want to do an SQL injection with the post variable to get the password column named as first_name in order for it to be printed in the page HTML. first_name is also a column name in the table.

I tried this but it won't work:

SELECT * FROM login where email = '1' or '1' = '1' union select null, first_name, null as col, null as col, null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col,null as col from login;

Any ideas on how to achieve this?

Answer 1

To me it looks like your problem is not so much with the injection as it is with the SQL.

• You are just selecting first_name from login. You are not selecting password. In an SQL UNION, the column names will be taken from the first query, so you don't have to bother renaming anything. However, if the password is the Nth field in the first query, it must also be the Nth field in the second query. Since the names in the second part is irrelevant you don't nead any AS.
• Also, you must make sure that both queries have the same number of columns with the same types!
• It looks like the original query only expect one row as a result, so you should probably honor that expectation by adding a where clause. Now you are first selecting all rows in login once in the left part (since 1 = 1 is always true), and then you are selecting each row again in the right part.

You probably want to end up with a query a bit like this:

SELECT * FROM login WHERE email = 'doesnotexist'
UNION ALL
SELECT null, password, null, ... FROM login WHERE email = '[email protected]'

Note that in the above query you have made sure the first part don't match anything. Then in the second part you pick your target email and take care that the password end up in the username column (second column in this example).