Skip to content

SQL-injection.md

Latest commit

 

History

History
119 lines (72 loc) · 2.31 KB

SQL-injection.md

File metadata and controls

119 lines (72 loc) · 2.31 KB

SQL Injection Vulnerability Report

1. Overview

This report documents a SQL Injection vulnerability identified in DVWA during security testing.

Testing Type: Offensive + Defensive Analysis
Environment: Local Lab
Security Level Tested: Low

2. Vulnerability Details

  • Vulnerability Name: SQL Injection
  • Severity: Critical
  • Category: OWASP Top 10 – Injection
  • Affected Module: DVWA SQL Injection Module

3. Description

The application fails to properly validate user input before executing SQL queries. User-controlled input is directly inserted into the SQL statement, allowing attackers to manipulate the query logic.

4. Proof of Concept (PoC)

Payload Used:

1' OR '1'='1

Steps to Reproduce:

  1. Login to DVWA.
  2. Navigate to the "SQL Injection" module.
  3. Enter the payload in the User ID field.
  4. Click Submit.

Evidence Screenshot:

SQL Injection PoC

Observed Result:

Multiple user records were returned including:

  • admin
  • Gordon Brown
  • Hack Me
  • Pablo Picasso
  • Bob Smith

This confirms successful SQL Injection.

5. Technical Analysis

Original Backend Query (Insecure Concept):

SELECT first_name, last_name FROM users WHERE user_id = '$id';

After Injection:

SELECT first_name, last_name FROM users WHERE user_id = '1' OR '1'='1';

Since '1'='1' always evaluates to TRUE, the database returns all records.

6. Impact Analysis

If exploited in a real-world application, this vulnerability could lead to:

  • Unauthorized data access
  • Database enumeration
  • Admin account discovery
  • Password hash extraction
  • Complete system compromise

7. Root Cause

  • Lack of input validation
  • Use of dynamic SQL queries
  • No parameterized query implementation

8. Risk Classification

Severity Level: Critical
Reason: Direct database manipulation and data exposure possible.

9. Remediation Strategy

To prevent SQL Injection:

  • Use Prepared Statements
  • Implement Parameterized Queries
  • Validate and sanitize user input
  • Apply Least Privilege Principle

Secure Query Example (Conceptual):

$stmt = $pdo->prepare("SELECT first_name FROM users WHERE user_id = ?"); $stmt->execute([$id]);

10. Ethical Disclaimer

This testing was performed in a controlled lab environment (DVWA) strictly for educational purposes.