This application contains a SQL injection vulnerability in the product category filter.
You can use a UNION attack to retrieve the results from an injected query.
Your goal is to display the database version string.
For MySQL: Try using UNION SELECT @@version or VERSION()
For Microsoft SQL Server: Try using UNION SELECT @@version or VERSION()
Example payload: Gifts' UNION SELECT NULL, 'Version', 'Description', 0, 'Category', 1 --
High performance laptop
Price: $1200.00
Category: Electronics
Released: Yes
Latest model smartphone
Price: $800.00
Category: Electronics
Released: Yes
Ceramic coffee mug
Price: $15.00
Category: Home
Released: Yes
Generic gift card
Price: $25.00
Category: Gifts
Released: Yes
Learn SQL injection
Price: $40.00
Category: Books
Released: Yes
You've successfully retrieved the database version!
Challenge completed. You have demonstrated how SQL injection can be used to extract database information.