+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Blackbox SQLi: MySql "error in your SQL syntax" when larger "UNSIGNED BIGINT" (/showthread.php?tid=5845975)
Blackbox SQLi: MySql "error in your SQL syntax" when larger "UNSIGNED BIGINT" - zhouyu - Jun 8, 2018
Hello,
I'm trying to hack a website, the URL has the form http://example.com/a/[integer_value]/something_else
When trying to change [integer_value], quotes (double and single), characters ... does not have any affect. But, when the [integer_value] larger than UNSIGNED BIGTINT, there'll be an SQL error throwed. That's to say:
1. if 0 <= [integer_value] <= ( UNSIGNED BIGTINT, which is 2^64-1) => no error
2. if [integer_value] >UNSIGNED BIGTINT, error:
e.g. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '18446744073709551616' at line 1
Any ideas ?
Is this exploitable ?
RE: Blackbox SQLi: MySql "error in your SQL syntax" when larger "UNSIGNED BIGINT" - Ahmed El Melegy - Jun 21, 2018
pm me the site to see if you can
regards