Error-based SQL Injection

Error-based SQL Injection

Description

An error-based attack is based on errors emitted by the database server, which allows understanding the database structure and exfiltrating database content.

Impact

- Allow an attacker to interfere with the queries that an application makes to its database.
- Retrieve information from the database an even extract data.
- Affect the authentication and authorization aspects of the application.
- Steal sensitive information stored in databases.

Recommendation

- Use of prepared statements (with parameterized queries).
- Use of stored procedures.
- Enforcing the least privilege.

Threat

Anonymous attacker from an intranet.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the src.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: L

Temporal

  • Exploit code maturity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X
  • Score:
    • Base: 7.3
    • Temporal: 7.3
  • Severity:
    • Base: High
    • Temporal: High

Score 4.0

Default score using CVSS 4.0. It may change depending on the context of the src.

Base 4.0

  • Attack vector: N
  • Attack complexity: L
  • Attack Requirements: N
  • Privileges required: N
  • User interaction: N
  • Confidentiality (VC): L
  • Integrity (VI): L
  • Availability (VA): L
  • Confidentiality (SC): N
  • Integrity (SI): N
  • Availability (SA): N

Threat 4.0

  • Exploit maturity: X

Result 4.0

  • Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
  • Score:
    • CVSS-BT: 6.9
  • Severity:
    • CVSS-BT: Medium

Compliant code

The application performs queries using standardized and sanitized parameters `java static void getQuery(param){ param = java.net.URLDecoder.decode(param, ""UTF-8""); //Clean User parameters cleanParam = getCleanValue(param) //Do Query with a standard sentence String sql = ""INSERT INTO users (username, password) VALUES ('foo','""+ cleanParam + ""')"";

try { java.sql.Statement statement = org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement(); org.owasp.benchmark.helpers.DatabaseHelper.outputUpdateComplete(sql, response); } catch (java.sql.SQLException e) { ... ); }

Non compliant code

The application contains possible harmful time-delay query

                static void getQuery(userSql){
  try {
    java.sql.Statement statement = org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement();

// make query without filtering user input org.owasp.benchmark.helpers.DatabaseHelper.outputUpdateComplete(sql, response); } catch (java.sql.SQLException e) { ... ); }

Requirements

Fixes

Free trial message
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.