Objective
Exploit a UNION-based SQL Injection vulnerability in the product category filter to retrieve the administrator's password from the database.
Background
The application displays products based on the category passed in the URL parameter. The query returns two columns (name and description) and displays them on the page.
The users table contains columns: username and password.
The Code (Simulated)
The backend is executing a query similar to this:
SELECT name, description FROM products
WHERE category = 'URL_PARAMETER'
How to Exploit
A UNION attack allows you to combine the results of the original query with the results of an injected query.
- Determine the number of columns returned by the original query (it's 2 here).
- Inject a UNION SELECT statement to pull data from another table.
- Because it expects two columns, your injected query must also return two columns.
Click on the URL bar at the top of the browser to edit the category parameter.
Hint: Try changing the category to: ' UNION SELECT username, password FROM users--