I was practising on OWASP Mutillidae, and I met a problem. There's a task that examines our knowledge of UNION query.
The vulnerable query is:
SELECT * FROM accounts WHERE username='
The accounts table has 5 columns, and we want to obtain schema_name from information_schema.schemata
So I write [John' UNION ...] in the username box and the query should become to this:
SELECT * FROM accounts WHERE username='John' UNION SELECT NULL,NULL,NULL,schema_name,NULL FROM information_schema.schemata
But it will return Syntax error or the number of columns is wrong.
How should I write the malicious string to make it work? Thanks!