Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The category value controls both category selection and the release predicate: the inferred query ends with AND released = 1; Accessories’ or ‘1’=’1’ – makes the WHERE clause true and comments that release check. The injected true branch comments out released = 1, causing hidden products to appear.

Lab objective/setup

Exercise SQL injection vulnerability in WHERE clause allowing retrieval of hidden data through the endpoint and input recorded in the lab note. The inferred query ends with AND released = 1; Accessories' or '1'='1' -- makes the WHERE clause true and comments that release check.

What I observed

the inferred query ends with AND released = 1; Accessories' or '1'='1' -- makes the WHERE clause true and comments that release check.

The inferred query ends with `AND released = 1`; `Accessories' or '1'='1' --` makes the WHERE clause true and comments that release check.
The inferred query ends with `AND released = 1`; `Accessories' or '1'='1' --` makes the WHERE clause true and comments that release check.

Why it is vulnerable

The inferred query ends with AND released = 1; Accessories' or '1'='1' -- makes the WHERE clause true and comments that release check. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Compare the ordinary Accessories listing with the same category followed by the true predicate and comment. Verify the bypass by the additional unreleased product rows, not merely by a successful status code.
The ordinary listing is the control; the newly visible product names are the evidence that the trailing release condition no longer governs the query.

The unmodified category=Accessories URL shows only released rows from the products table, including Werewolf Wacker, as the SQL WHERE-clause control.
The unmodified category=Accessories URL shows only released rows from the products table, including Werewolf Wacker, as the SQL WHERE-clause control.
The category parameter appends a true OR 1=1 predicate and SQL comment; additional unreleased product cards appear, proving the released filter was removed.
The category parameter appends a true OR 1=1 predicate and SQL comment; additional unreleased product cards appear, proving the released filter was removed.

Verification

The lab is confirmed when the inferred query ends with AND released = 1; Accessories' or '1'='1' -- makes the WHERE clause true and comments that release check. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

A WHERE-clause flaw can bypass publication and tenancy constraints. Parameterize category input and enforce release visibility through a separate, non-user-controlled policy layer.

References