SQL injection in POST-Content - Printable Version

SQL injection in POST-Content - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: SQL injection in POST-Content (/showthread.php?tid=4598238)

SQL injection in POST-Content - ~flexen - Dec 23, 2014

Hi,
I got a quick question.

Theres an exploit where you add an SQL-query to the post content with HTTP Live Headers
It looks like this:

Code 
&cat[0]=1) UNION SELECT concat(.....

What does the

Code 
&cat[0]=1)

part exactly do?
And is there a way to generally determine when to inject via the post content method?
Thanks. ✌

* - benzi - Dec 23, 2014

well, the parameter is 'cat', and the injection point is inside ()'s.
the query probably looks like that-
SELECT.... WHERE cat_id IN (1,2,3,4$injection)