Lab: SQL injection UNION attack, determining the number of columns returned by the query
Summary: PortSwigger's lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and can be exploited with a UNION attack to retrieve data from other tables. The lab's first step is determining how many columns the query returns, done by modifying the category parameter to add a column containing a null value.
What you should know: A filter parameter that echoes query results back to the user is enough to let an attacker enumerate column counts and then pull data from other tables - the reconnaissance step that precedes the full attack.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026