If the website is returning an SQL syntax error to you, then you definitely have found an SQLi vulnerability. You're not dealing with a WAF (sometimes it can be hard to tell the difference). It also means that, conveniently for you, he has error printing turned on. That makes it much easier to tell what is going on. That's also a vulnerability he should fix.
That being said, onto the SQLi! Getting the payload syntax right can be tricky. However, the error message will help a lot. I'd look at this part:
'1or '1'='1' and test = '0' and version = '1''
Note that MySQL itself wraps single quotes around the part that it says is broken, so if we should remove the outer single quotes we can see what MySQL is actually trying to execute:
1or '1'='1' and test = '0' and version = '1'
Which is mildly confusing because it doesn't match your payload very well ('1 or 1=1
). This likely means that he is doing additional translations behind the scenes to try to mitigate SQLi. Unfortunately (for him) his ad-hoc implementation definitely isn't foolproof (since you're producing MySQL errors). Most likely the actual query he is executing is:
WHERE column='?' and test = '0' and version = '1'
With the question mark standing in for the vulnerable parameter. This would normally be very easy to exploit, except that he seems to be doing some strange transformation to your data. In that sense, he may be doing something that is like a WAF in nature, so you'll have to do some playing around to build a successful PoC. I'd try something very different, like a SLEEP
based injection:
1' and sleep(10)
Simply by virtue of having a different "form" of the payload, you may evade his "filter". If the server takes ~10 more seconds to return the response, then you know you have a successful payload! From there you can try to build different kinds of payloads for extracting information, etc...
1
's from your injection are surrounded by'
(whihc shouldn't bother you) and seemingly your initial'
eats an already preent'
. What happens with'1 or 1=1 --
or perhaps'1' or 1=1 --
?