I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table.
(It's running MySQL 5.X with PHP)
So I'm using this to retrieve all databases:
valid_user_name' and ( SELECT substr(hex(schema_name), 8, 1) FROM information_schema.schemata WHERE schema_name not in ('performance_schema','mysql','information_schema') ORDER BY schema_name limit 0, 1) = '9' #
The first database name is
radius, so the 8th char of
hex('radius') is '9'.
With the input above the web page shows the user exist.
But when I provide character
'7' it also shows the user exist.
All the rest do not show so.
Anyone know why?
P.S You might thought the injection point is a false positive, but it's not. I have confirmed that with SQLmap.