Lab: SQL injection UNION attack, retrieving multiple values in a single column
Summary: PortSwigger's lab presents a SQL injection vulnerability in a product category filter, where query results are returned in the application's response and can be exploited with a UNION attack to pull data from other tables. The database holds a separate users table with username and password columns, and solving the lab requires retrieving all usernames and passwords and using them to log in as the administrator user.
What's compelling: The path from a single injectable filter parameter to every username and password in the users table, including the administrator's, is the whole attack chain here, and it runs through an input field the application returns results from by design.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026