Hi There!
I'm not sure if this was already found, but I found a small bug while working through bwapp. When an error is tossed by adding a ', the error...
"Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1"
is tossed. When adding a character after the ', for example "a", the error becomes...
"Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''a' at line 1."
This means input from the http request can be put into the http response. Here's a PoC on bwapp.
https://gyazo.com/18cb58421f25d0f23ac2515c170eb8b4.
Of course SQL injection is much more dangerous, but XSS is an added bonus.
[if this has already been released, please inform me and cite a existing article]
"Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1"
is tossed. When adding a character after the ', for example "a", the error becomes...
"Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''a' at line 1."
This means input from the http request can be put into the http response. Here's a PoC on bwapp.
https://gyazo.com/18cb58421f25d0f23ac2515c170eb8b4.
Of course SQL injection is much more dangerous, but XSS is an added bonus.
[if this has already been released, please inform me and cite a existing article]