Part 1 on SQLI Today as a web penetration tester I learned about an SQL injection vulnerability in…

Part 1 on SQLI
Today as a web penetration tester I learned about an SQL injection vulnerability in the WHERE clause that allows retrieval of hidden data I performed a SQL injection attack that caused the application to display one or more unreleased products

My solution

I used burp suits to intercept and modify the request that set the product category filter
2 ) then I modify the category parameter by giving it a value of ( 'OR ' 1 '=' 1)