SQLi2RCE: another discovery 🤯️ (part 2)

I was in PMA — looking closer, I noticed, query isn't exactly what I wrote.

It had:

SELECT * FROM `users` UNION SELECT * FROM `users` INTO OUTFILE '/tmp/lol' LIMIT 0, 25

SELECT * FROM `users` UNION SELECT * FROM `users` INTO OUTFILE '/tmp/lol' LIMIT 0, 25

While I wrote:

SELECT * FROM `users` UNION SELECT * FROM `users` INTO OUTFILE '/tmp/lol'

SELECT * FROM `users` UNION SELECT * FROM `users` INTO OUTFILE '/tmp/lol'

For a second with my brain numb, I passed this to AI, saying "nah this doesn't work bro", then he replied that it should work, etc… (here see)

And I thought to give it another try, but this time, added a comment line:

And it worked !) (authorized SQLi in PMA haha, but this is not the point) (notice how important it is to read the errors and understand them)

So it's just PMA adding that LIMIT thing, for its UI, remember we are running our SQL from PMA which is our web SQL client.

To confirm that the problem is only on PMA end, I ran this test first, with mysql bash cli

Then now I said, wait a sec, then — why not just select my text I want, just keeping same columns to avoid an error:

And as you can see it works !)

Also WHERE statement being in 1st SQL SELECT doesn't bother, which is great for real case escalations.

I like to learn more about syntax by probing, cause if it works it works xD

And no guide will tell you all details about a programming language.

That's it, happy hacking !)

another motivation to find SQLi in real targets :D

(idk if its dejavue or I am rediscovering smth I did and forgot, but anyways, it doesn't matter rn, at least I've made another clean write-up that'll help me to always remember this. Cause similar situations happened a lot, but imo this is remarkable enough to not forget.)