HexBrain

Mars · Report #2266081

Blind SQL Injection on █████ via URI Path

Validstatus
criticalseverity
29upvotes
14 Feb 2024disclosed

Summary

Time-based SQL injection is a hacking technique that capitalizes on vulnerabilities in systems interacting with databases. Unlike traditional SQL injection methods that directly manipulate data, this approach leverages delays in database processing to extract information. Attackers insert malicious SQL statements into input fields of web applications lacking sufficient security measures. If successful, these statements execute against the database, and by intentionally causing delays in processing, the attacker can infer information about the database structure or obtain sensitive data based on the application's response time to specific queries.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original