3
The SQL statement executed when you input ' UNION SELECT '123' AS password# is:
SELECT password FROM admins WHERE username='' UNION SELECT '123' AS password#'
The pound sign is there so that the closing ' from the original format string, which is now trailing at the end of the query, does not tigger a syntax error. This is a MySQL extension to the SQL ...
2
In MySQL, # represents the start of a comment. This means the rest of the line will not be parsed as SQL. This is a common technique in SQL injection to force the trailing SQL after the injected SQL to be ignored.
In this case, by putting ' UNION SELECT '123' AS password# in the username field, it makes the command that's executed:
SELECT password FROM ...
2
AND 1=1 is a common SQL Injection payload to select all results of an SQL query since it always evaluates to true.
It being sent along with the URL can be for numerous reasons, but it might be an indicator for an SQL Injection vulnerability if the URL parameter is directly fed into an SQL statement and is not properly sanitized beforehand.
1
Some things you can try:
Check for credential re-use. For example, can you log into the SSH server using the DB credentials?
Try to get code execution on the server. Since the web server obviously has access to the database, if you can launch another process with the web server's permissions, you should be able to access the DB from there.
Attempt SQL ...
1
Your intuition is correct that this does not provide sufficient protection against SQL injection. You may need to treat this it as a blind SQL injection
have a couple of options for explaining how to exploit this:
Attack the first SQL with a union returning one column - you can get information out of if there's different behavior between failure of the ...
1
use this code
<script>eval('al' + 'ert(1)')</script>
<script>eval(String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41))</script>
<meta http-equiv="refresh" content="0;url=javascript:alert(1);">
Only top voted, non community-wiki answers of a minimum length are eligible
