SQL injection in the WHERE clause: how to reach unreleased products (PortSwigger)
Another lab from PortSwigger Academy: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data. The goal is simple: display one or more unreleased products via SQL injection.
Starting point
The shop filters products by category. In Burp I intercepted the request for opening a product description. The GET request includes the parameter productID=6, the product number.
Hypothesis
Task tells us that server-side SQL query contains a released = 1 condition. If so, perhaps released = 0 would show products that haven't gone on sale yet. So the trick is to make that condition stop applying.
Where I got stuck
I forgot that closing the query takes more than an apostrophe '. You also need to comment out the rest of the statement, which is what the double dash -- does. Without it, the remainder of the query either breaks the syntax or keeps filtering the results.
Then came a second problem. In the "Gifts" category one unreleased product showed up, but the lab wasn't marked as solved. I looked at the solution and it turned out you need to display all products using the 1=1 method. In my opinion that contradicts the task wording "one or more", since the task suggests that one product or a few is enough.
Exploit
' OR 1=1-- The condition 1=1 is always true, so the query returns every product, including those with released = 0. Just '-- on its own should work too.
How to defend against it
Parameterized queries. User input is passed to the query as a parameter rather than concatenated into the query text, so ' and -- can't change the query's structure.
Takeaways
- With SQLi, think about the whole query, not just the injection point: you need to close the string and comment out the rest.
- Solving a lab can depend on a specific condition being checked, not just on the results looking right.
