Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The page exposes one printable UNION column, so the source combines two fields into it: the direct two-value UNION errors; column two accepts text, and username||’:’||password renders both values together. PostgreSQL concatenation preserves both username and password in one rendered value.

Lab objective/setup

Exercise SQL injection UNION attack, retrieving multiple values in a single column through the endpoint and input recorded in the lab note. The direct two-value UNION errors; column two accepts text, and username||':'||password renders both values together.

What I observed

the direct two-value UNION errors; column two accepts text, and username||':'||password renders both values together.

The direct two-value UNION errors; column two accepts text, and username||':'||password renders both values together. The final `category` UNION places `username||':'||password` in column two so the administrator pair appears in one rendered value.
The direct two-value UNION errors; column two accepts text, and username||':'||password renders both values together. The final `category` UNION places `username||':'||password` in column two so the administrator pair appears in one rendered value.
The direct two-value UNION errors; column two accepts text, and `username||':'||password` renders both values together.
The direct two-value UNION errors; column two accepts text, and `username||':'||password` renders both values together.

Why it is vulnerable

The direct two-value UNION errors; column two accepts text, and username||':'||password renders both values together. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Confirm which of the two columns accepts text, then select username||':'||password into that position with null in the other. Read the administrator pair from the combined output and use it only in the lab login.

The combined output displays each username and password separated by a colon in the single printable product-result column.
The combined output displays each username and password separated by a colon in the single printable product-result column.
Confirm which of the two columns accepts text, then select `username||':'||password` into that position with null in the other. Read the administrator pair from the combined output and use it only in the lab login.
Confirm which of the two columns accepts text, then select `username||':'||password` into that position with null in the other. Read the administrator pair from the combined output and use it only in the lab login.

Verification

The lab is confirmed when the direct two-value UNION errors; column two accepts text, and username||':'||password renders both values together. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

Limited output width does not prevent bulk credential disclosure. Prepared statements and separation of the application role from the users table are the primary controls.

References