Lab: SQL injection UNION attack, finding a column containing text

Summary: This PortSwigger lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and can be exploited with a UNION attack to retrieve data from other tables. The lab requires determining the number of columns returned by the query, verifying it returns three columns, and identifying a column compatible with string data by making a random value provided by the lab appear in the results.
Bottom line: A category filter that returns query results directly in the response is enough for an attacker to enumerate column counts and pull data from other tables, so any input reaching a SQL query without proper parameterization carries that exposure.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026