SQL Injection in the Query Structure - Port Swigger
Summary: PortSwigger Research describes SQL injection into the structure of a query rather than into a data value, where the attacker supplies valid syntax directly and no escaping is needed to break out of a data context. The most common structural injection point is the ORDER BY clause, which takes a column name or number and is often exposed to users for sorting table results in the browser.
What's compelling: Because a database will not accept UNION, WHERE, OR, or AND at that position, exploitation instead uses a nested query that tests one piece of information at a time, letting an attacker extract an entire string one byte at a time by cycling through ASCII codes until a hit occurs.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026