Waraxe IT Security Portal

Snap · Active user

I got this URL

delete_message&
type=sender_deleted&
message_id=4&
page=messaging&
section=sent&
start=0&
limit=50&
order_field=m.reg_date&
order_type=DESC

If i modify the field

order_field=m.reg_date& to order_field=' HERE IS THE INJECTION&

I get

Error MySql: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' HERE IS THE INJECTION DESC LIMIT 0, 50' at line 7

Query SQL: SELECT a.name, u.username AS receiver_username, w.name AS wanted_name, m.* FROM prid_meging m LEFT JOIN prid_auons a ON a.auction_id=m.auons_id LEFT JOIN prd_waed_as w ON w.wed_ad_id=m.wed_ad_id LEFT JOIN prd_users u ON u.user_id=m.receiver_id WHERE m.sender_id='54893' AND m.sender_deleted=0 ORDER BY ' HERE IS THE INJECTION DESC LIMIT 0, 50

What can i do with this ... Wink

Thanks in advance