[zhouyu]

Hello,
I'm trying to hack a website, the URL has the form http://example.com/a/[integer_value]/something_else

When trying to change [integer_value], quotes (double and single), characters ... does not have any affect. But, when the [integer_value] larger than UNSIGNED BIGTINT, there'll be an SQL error throwed. That's to say:

1. if 0 <= [integer_value] <= ( UNSIGNED BIGTINT, which is 2^64-1) => no error
2. if [integer_value] >UNSIGNED BIGTINT, error:
e.g. You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '18446744073709551616' at line 1

Any ideas ?

Is this exploitable ?

[Ahmed El Melegy]

pm me the site to see if you can

regards