MYSQL 通过NAME_CONST()报错注入

函数解释

NAME_CONST(name,value）

Returns the given value. When used to produce a result set column, NAME_CONST() causes the column to have the given name. The arguments should be constants.

mysql> SELECT NAME_CONST('myname', 14);
+--------+
| myname |
+--------+
|     14 |
+--------+ 

This function is for internal use only. The server uses it when writing statements from stored programs that contain references to local program variables, as described in [Section 19.6, “Binary Logging of Stored Programs”], You might see this function in the output from mysqlbinlog.

报错原理

mysql列名重复会导致报错,通过name_const制造一个列

我们可以利用mysql列名重复会导致报错这个原理配合join函数得到列名using 等价 join 中的On

约束条件

查询的内容需是定值(约束条件过于苛刻，可操作的内容极其少)

注入语句

and exists(select * from (select * from(select name_const(操作代码,0)) a join (select name_const(操作代码,0)) b)c)

举例

返回主页