Skip to main content

Error-based SQL Injection

Description​

An error-based attack is based on errors emitted by the database server, which allows understanding the database structure and exfiltrating database content.

Impact​

  • Allow an attacker to interfere with the queries that an application makes to its database.
  • Retrieve information from the database an even extract data.
  • Affect the authentication and authorization aspects of the application.
  • Steal sensitive information stored in databases.

Recommendation​

  • Use of prepared statements (with parameterized queries).
  • Use of stored procedures.
  • Enforcing the least privilege.

Threat​

Anonymous attacker from an intranet.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the src.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: L

Temporal​

  • Exploit code maturity: X
  • Remediation level: X
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 7.3
    • Temporal: 7.3
  • Severity:
    • Base: High
    • Temporal: High

Score 4.0​

Default score using CVSS 4.0 . It may change depending on the context of the src.

Base 4.0​

  • Attack vector: N
  • Attack complexity: L
  • Attack Requirements: N
  • Privileges required: N
  • User interaction: N
  • Confidentiality (VC): L
  • Integrity (VI): L
  • Availability (VA): L
  • Confidentiality (SC): N
  • Integrity (SI): N
  • Availability (SA): N

Threat 4.0​

  • Exploit maturity: X

Result 4.0​

  • Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
  • Score:
    • CVSS-BT: 6.9
  • Severity:
    • CVSS-BT: Medium

Compliant code​

The application performs queries using standardized and sanitized parameters

static void getQuery(param){
  param = java.net.URLDecoder.decode(param, ""UTF-8"");
  //Clean User parameters
  cleanParam = getCleanValue(param)
  //Do Query with a standard sentence
  String sql = ""INSERT INTO users (username, password) VALUES ('foo','""+ cleanParam + ""')"";

  try {
    java.sql.Statement statement = org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement();
    org.owasp.benchmark.helpers.DatabaseHelper.outputUpdateComplete(sql, response);
  } catch (java.sql.SQLException e) {
    ...
  );
}

### Non compliant code
The application contains possible harmful time-delay query
```java
static void getQuery(userSql){
  try {
    java.sql.Statement statement = org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement();

    // make query without filtering user input
    org.owasp.benchmark.helpers.DatabaseHelper.outputUpdateComplete(sql, response);
  } catch (java.sql.SQLException e) {
    ...
  );
}

Requirements​

Fixes​

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Last updated on