Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The vulnerable product filter places category into an Oracle query. A two-column UNION first enumerates all_tables, then uses user_tab_cols to discover the randomized credential columns before selecting the administrator row from USERS_GSEMNG.

Lab objective/setup

The injection point is GET /filter?category=<value> on an Oracle back end. The objective is to identify the unknown users table and its columns, retrieve the synthetic administrator credential, and authenticate in the Academy lab.

What I observed

The response could render two text values from a UNION SELECT. Oracle does not expose information_schema; its data dictionary supplied the required metadata. Querying all_tables revealed USERS_GSEMNG, and user_tab_cols returned USERNAME_RKTXFE and PASSWORD_YCJIMQ.

The initial category request is captured in Repeater before testing the Oracle UNION injection point.
The initial category request is captured in Repeater before testing the Oracle UNION injection point.
An Oracle UNION SELECT with two text values and FROM dual renders both markers, confirming a two-column text-compatible result.
An Oracle UNION SELECT with two text values and FROM dual renders both markers, confirming a two-column text-compatible result.
UNION SELECT owner,table_name FROM all_tables returns the randomized USERS_GSEMNG table in Oracle data-dictionary output.
UNION SELECT owner,table_name FROM all_tables returns the randomized USERS_GSEMNG table in Oracle data-dictionary output.

Why it is vulnerable

The application concatenates the category value into SQL, allowing the original query to be extended with attacker-selected rows. The database account can also read Oracle catalog views and the credential table, so the injection crosses both a query-boundary failure and an excessive-privilege boundary.

Walkthrough in the authorized PortSwigger lab

  1. Confirm the response accepts two text columns with an Oracle-compatible UNION SELECT using dual where a table is required.
  2. Request a' UNION SELECT owner, table_name FROM all_tables -- - and inspect the rendered rows for the randomized users table, USERS_GSEMNG.
  3. Request a' UNION SELECT column_name,'aa' FROM user_tab_cols WHERE table_name = 'USERS_GSEMNG' -- - to recover USERNAME_RKTXFE and PASSWORD_YCJIMQ.
  4. Select those fields from the discovered table with a' UNION SELECT USERNAME_RKTXFE, PASSWORD_YCJIMQ FROM USERS_GSEMNG -- -.
  5. Use the returned synthetic administrator credential on the lab login page.
A user_tab_cols query for USERS_GSEMNG reveals columns USERNAME_RKTXFE and PASSWORD_YCJIMQ in the rendered response.
A user_tab_cols query for USERS_GSEMNG reveals columns USERNAME_RKTXFE and PASSWORD_YCJIMQ in the rendered response.
Selecting USERNAME_RKTXFE and PASSWORD_YCJIMQ from USERS_GSEMNG returns the administrator row and its synthetic password.
Selecting USERNAME_RKTXFE and PASSWORD_YCJIMQ from USERS_GSEMNG returns the administrator row and its synthetic password.
The My account page shows the administrator session after login with the credential recovered from the Oracle users table.
The My account page shows the administrator session after login with the credential recovered from the Oracle users table.

Verification

The result is supported by a linked sequence: all_tables reveals the table, user_tab_cols reveals its schema, the final UNION returns credential rows, and the administrator value is accepted by the lab login. The solved state confirms that the catalog-derived data was correct.

Impact and defensive lesson

A UNION injection with catalog access can turn one filter parameter into broad schema discovery and credential disclosure. Parameterize the category query, grant the application account only the tables and views it needs, avoid storing reusable passwords, and monitor unexpected catalog queries from application identities.

References