this tut will give you instructions how to inject after order by/limit.

like that

here - injection point.
we cant use union after those clauses,so we gonna play with the other things we can do.

after order by id [here]
using double query.

if we have this site
the injection point is after order by.

i know i can use union in another onjection point,i do it for the tut.
after order by its simple,the only things we cant use is-
union,having,where,and some more things that dosent matter.
we can use 'and' for double query.
'5.0.95-community'


(i used the table 'products' because i can see that this table exist from the error. if you cant see the table,use 'information_schema.columns'.)

after desc/asc [here]
using double query.

if we have this site
the injection point is after desc.

after desc/asc its little more problem,because we cant use-
union,having,where,and,or,xor,*,>,so we cant execute our query.
so we add a comma,and the double query after that.
'5.0.95-community'


note-if the injection point is like that-
just add '1' and inject like that first example.

after limit 10,10 [here]
using some tricks.

like this site-
injetion point after limit clause.

when the injection point is after limit clause,we cant do anything,only those commands-
offset,into,into outfile/dumpfile,/*!*/,for update,lock in share mode.
so we try to exploit what we can.
toc-
get the version
full path disclosure
find column count

get the version (thanks to lolalu0)
we can use comments for getting the mysql version. 
we can guess it,and if its true,the page will not load,just like blind,but different.
page dont load-version bigger then 5.00.94
page load normally- version smaller than 5.00.96
page dont load- version is 5.00.95.

FPD
for Full Path Disclosure,we can 0 or /**/ the limit clause,and error with the full path will appear,even mysql_error is on.
for example
final query-
and


we can also
Warning: Division by zero in /home/teletec/public_html/include/products.php on line 164

find the column count
using into.
its not really will help,but its nice trick.
if we have this site-
injection point is after limit.
we can count the columns like that-


error 1222.
not 1 column.



error 1222.
not 2 column.

and so on until-


error 1172 "Result consisted of more than one row".
60 columns.

hope you learned something

作者 JUST FUCK IT!