Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The failed UNION without a table and the successful dual query identify Oracle semantics: a UNION without FROM fails; SELECT ‘A’,’b’ FROM dual succeeds, and SELECT ‘A’,banner FROM v$version displays the version. The second column then carries the banner from v$version.

Lab objective/setup

Exercise SQL injection attack, querying the database type and version on Oracle through the endpoint and input recorded in the lab note. A UNION without FROM fails; SELECT 'A','b' FROM dual succeeds, and SELECT 'A',banner FROM v$version displays the version.

What I observed

a UNION without FROM fails; SELECT 'A','b' FROM dual succeeds, and SELECT 'A',banner FROM v$version displays the version.

The initial `category` probes compare a tableless UNION with `SELECT 'A','b' FROM dual`, establishing that Oracle requires the dummy table.
The initial `category` probes compare a tableless UNION with `SELECT 'A','b' FROM dual`, establishing that Oracle requires the dummy table.
A UNION without FROM fails; `SELECT 'A','b' FROM dual` succeeds, and `SELECT 'A',banner FROM v$version` displays the version.
A UNION without FROM fails; `SELECT 'A','b' FROM dual` succeeds, and `SELECT 'A',banner FROM v$version` displays the version.

Why it is vulnerable

A UNION without FROM fails; SELECT 'A','b' FROM dual succeeds, and SELECT 'A',banner FROM v$version displays the version. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Keep the known two-column shape, add FROM dual to satisfy Oracle, and replace the second literal with banner selected from v$version. Compare the erroring request with the rendered version rows.

Keep the known two-column shape, add `FROM dual` to satisfy Oracle, and replace the second literal with `banner` selected from `v$version`. Compare the erroring request with the rendered version rows.
Keep the known two-column shape, add `FROM dual` to satisfy Oracle, and replace the second literal with `banner` selected from `v$version`. Compare the erroring request with the rendered version rows.
The Oracle category payload uses UNION SELECT NULL,banner FROM v$version with FROM dual-compatible syntax in Repeater.
The Oracle category payload uses UNION SELECT NULL,banner FROM v$version with FROM dual-compatible syntax in Repeater.
The product page prints Oracle Database 11g Express Edition and PL/SQL banner rows returned by UNION SELECT banner FROM v$version.
The product page prints Oracle Database 11g Express Edition and PL/SQL banner rows returned by UNION SELECT banner FROM v$version.

Verification

The lab is confirmed when a UNION without FROM fails; SELECT 'A','b' FROM dual succeeds, and SELECT 'A',banner FROM v$version displays the version. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

Version disclosure improves an attacker’s payload selection and confirms arbitrary SELECT execution. Parameterize the category filter and restrict access to system views.

References