Lab: Visible error-based SQL injection
Summary: This PortSwigger lab presents a SQL injection vulnerability in an analytics tracking cookie whose value is placed into a SQL query, with the query results not returned to the user. The lab requires leaking the administrator password from a users table with username and password columns by appending a single quote, commenting out the rest of the query, and using a generic SELECT subquery cast to an int data type so the resulting error message leaks the first username and then the administrator's password.
What's compelling: The error message itself is the exfiltration channel here: a single quote in a cookie value was enough to turn a failed type cast into a readable leak of the administrator's password, so any application that echoes database errors back to the client is handing over the users table one row at a time.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026