Classic UNION-based SQL Injection

web · easy · +25 XP

// what is Classic UNION-based SQL Injection?

SQL Injection happens when user input is concatenated into a SQL query instead of bound as a parameter. The attacker breaks out of the string literal, adds their own clauses (UNION SELECT, OR 1=1), and reads or modifies data they were never authorised to see. UNION-based extracts data column-by-column; boolean-based and time-based work blind (no error message visible).

// how attackers detect it

[01]Append a single quote ' to every input. If you get a 500 / SQL error → you found it.
[02]Try ' OR 1=1-- and see if you bypass authentication or get unexpected rows.
[03]Use sqlmap -u 'http://target?q=test' --batch to confirm + automate column enumeration.

// how defenders prevent it

✓Parameterised queries / prepared statements — every modern ORM does this. Never f"SELECT * WHERE x='{user}'".
✓Use a least-privilege DB user — read-only for the search endpoint, no DROP/UNION from the app account.
✓Web Application Firewall (CloudFlare / AWS WAF) catches the obvious payloads but is not a primary defense.

// real-world incidents

CVE-2023-34362

MOVEit Transfer SQLi

Cl0p ransomware gang exfiltrated data from 2000+ orgs in 2023.

CVE-2024-27198

TeamCity Auth Bypass + SQLi

Hardcoded credentials + SQLi led to ransomware deployments.

CVE-2022-22965

Spring4Shell + SQLi chains

Easily chained with RCE for full takeover.

// hands-on tips for this lab

›Schema hint: tables are posts, users, secrets. Target column is secrets.value.
›Try posts' UNION SELECT name,value FROM secrets WHERE name='admin_flag'--. The regex is forgiving — get the words right.

was this lesson helpful?

// start of web

Reflected XSS Sandbox

1 of 10 · web