Vulnerability Fixation
SQL Injection Vulnerabilities

SQL Injection Vulnerabilities

SQL Injection is a technique where attackers inject SQL code into application inputs to retrieve or manipulate database information. It compromises confidentiality, integrity, and in some cases availability of data. Attacks can lead to vertical or horizontal privilege escalation.

How SQL Injection Works

Attackers manipulate query parameters sent via HTTP (GET/POST) to alter backend SQL queries. Common vectors include:

• Query string parameters (e.g., http://abc.com/?id=1102 changed to 1102 OR 1=1).
• Form inputs (text, dropdowns) where malicious payloads are submitted.
• Intercepting and modifying requests with proxy tools (e.g., Burp Suite).
• Blind SQL Injection using unexpected inputs (NULL, blank, negative, very large values, out-of-range bounds) to cause errors, time delays, or resource exhaustion.