PortSwiggerlabs: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

Information :

This lab contains a SQL injection vulnerability in the product category filter. When the user selects a category, the application carries out a SQL query like the following:

To solve the lab, perform a SQL injection attack that causes the application to display one or more unreleased products.

Solution :

We first navigate the application just like a normal user. We’re mainly looking for parameters to inject in :

If we visit any of the products we find the product id paramter that we can try to inject , i first injected a simple payload to see if we can cause an internal error :

We only get Invalid Product ID , this is not the internal server error that we’re looking for, i added another ‘ to see if it will fix the query and remove the error but that didn’t work as well.

Moving on, we find another parameter when we try listing the categories :

Injecting a simple payload did return an internal server error :

To confirm it , either add another ‘ to fix the query or just comment the rest, if any of these 2 removes the error this is an indicator that we got an SQLi .

This does remove the error , which confirms the Vulnerability .

Now to exploit this , we see that we got 4 products returned to us when we select the Food&Drink category, we can use this SQLi to list all products from this table.

We can do that by simply using a payload that returns a True statement , for example 1=1 . What this will do is , either return products from the Food&Drinks Category or 1=1 which is always true and it should list all products that way.

In other words :

Since 1=1 is always true, the WHERE clause condition is bypassed entirely, returning all rows from the products table , including unreleased items and items from other categories.

'OR 1=1-- - : Make sure you comment the rest of the query to not have an internal error by breaking the query.

Perfect, we get a list of all products even unreleased ones.

That was all for this lab, see you in the next one :)