I want to ask about an sql injection vulnerability. I did't find a way to exploit it.

Question

I wanna know if vulnerability really exists if it exists if it is exploitable.

Zap tool give me some info like this....

' | case randomblob(10000000) when not null then'''' else '''' end

But i can' t understand it too much so please help me to exploit to learn...

Answer 1

Send a command like this to the driver:

SELECT * FROM Users WHERE UserId = 105 OR 1=1;

Since the test condition will always be true, you will get all of the rows in the USERS table,

including their passwords, account numbers, pin numbers etc.