Waraxe IT Security Portal

tommy · Beginner

Hi there,

I discovered an exploitable site.

The URL looks like this: http://www.site.com/list.php?search=asdf

This query gets executed:
SELECT * FROM sometable WHERE somecolumn LIKE '%asdf%';

I tried to use a UNION SELECT (I know the column-count of "sometable"), but the PHP script splits the input by commas (probably using explode() ).

So if I enter search=a,b,c, this query is executed:

SELECT * FROM sometable WHERE somecolumn LIKE '%a%' AND somecolumn LIKE '%b%' AND somecolumn LIKE '%c%';

Can anybody please help me how to use a UNION SELECT here?

Thanks in advance,

tommy

waraxe · Site admin

Seems to be complicated case. You can:

1. try to search other sql injections in same website
2. use subselects and blind injection, so that instead of