Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
Summary: PortSwigger's Web Security Academy lab describes a SQL injection vulnerability in a product category filter, where selecting a category runs a query of the form SELECT * FROM products WHERE category = 'Gifts' AND released = 1. The stated solution is to intercept the request in Burp Suite, change the category parameter to '+OR+1=1--, and confirm the response returns one or more unreleased products.
Key Takeaway: The lab's payload defeats the released = 1 condition with a single appended OR clause, so any filter built by concatenating user input into a WHERE clause can expose records the application intended to hide.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026