Waraxe IT Security Portal

draino · Beginner

For fun, I decided to test one of my companies products and it seems to be vulnerable to SQL injection.. So far I have gotten it to spew some good error messages, but I haven't quite got it doing what I want yet.. It's a simple username/password form on a webpage. Here is some of my test strings and results, maybe someone knows of something else I can try?

Username: ''='
Password: ''='

Gives error: ERROR: ERROR: Function 'edf_verify_admin(bool)' does not exist

Username: admin
Password: ') or ('x'='x

Gives error: ERROR: ERROR: left-hand side of OR is type 'character', not 'boolean'

Username: admin
Password: UNION SELECT TOP 1 TABLE_NAME FROM INFORMATION_SCHEMA.TABLES--

Gives error: ERROR: server closed the connection unexpectedly

----------

I do know that this is running on PostgreSQL on Linux.

None of these tests have logged me in.. I also get an invalid username/password error below these errors. I have also received other errors like unterminated quoted string, etc.. I have also tried every single one of the 'OR 1=1 type of strings in the username field as other websites have suggested. I would appreciate any feedback/idea's. Thanks!