SQL Injection

  • Fabian Sinner
  • January 19, 2024

Table of content

    SQL Injection

    SQL injection (SQLi) is a type of cyberattack in which an attacker inserts malicious SQL code into a database query to manipulate the underlying database of a web application system.

    This type of attack aims to exploit the vulnerabilities in the application layer, especially in input validation. SQL injection can be used to steal confidential data, modify databases, manipulate transactions, or even gain administrative control over a system.

    How SQL injection works

    The functionality of SQL injection (SQLi) is based on the exploitation of vulnerabilities in the input processing of an application that interacts with a database.

    The attacker searches for points in the application where user input is accepted (e.g., login forms, search fields). By inserting SQL code fragments into these input fields, the attacker tries to find out if the application passes the input directly to the database without validating or sanitizing it.

    Once a vulnerability is identified, the attacker inserts specially constructed SQL code into the input fields. The inserted code is sent to the database as part of the application’s original SQL query. This can change the structure of the query so that it no longer performs the originally intended function.

    Modified queries allow the attacker to extract sensitive information such as user data, passwords, or other confidential data from the database. The attacker can also change or delete data, which can lead to data loss or corruption. In extreme cases, the attacker can gain control of the database and execute administrative commands.

    What types of SQL injection are there?

    SQLi is a widespread attack technique that can be divided into several categories, depending on how the attack is carried out and which vulnerabilities are exploited. The main types of SQL injection are:

    1. In-band SQLi (classic SQLi):

    – Error-based SQLi: The attacker intentionally causes a database error in order to gain useful information from error messages. This method is often used to determine the structure of the database.

    – Union-based SQLi: The attacker uses the UNION SQL operator to extract additional, unwanted results from the database, which are then displayed in the HTTP response of the application.

    1. Inference-based SQLi (Blind SQLi):

    – Boolean-based Blind SQLi: The attacker sends an SQL query to the database, which causes the application to respond differently depending on the truth value of the query. By observing these reactions, the attacker can draw conclusions about the database.

    – Time-based Blind SQLi: Here, the attacker causes a time delay in the database response based on a specific SQL query. The duration of the response provides information about the structure of the database.

    1. Out-of-band SQLi:

    – This technique is used when the attacker is not able to use the database through the same communication channels that were used for the attack. Instead, they use alternative channels, such as sending data directly to a server controlled by the attacker.

    1. Compound SQLi:

    – Second-Order SQLi: Here the attacker initially leaves malicious input information in the application, which is triggered at a later time. For example, it might be set off by another function of the application.

    – SQLi in stored procedures: This type refers to the use of SQLi in stored procedures or scripts in the database itself.

    1. Automated SQLi:

    – This is where attackers use automated tools to quickly and efficiently find and exploit SQLi vulnerabilities in web applications.

    Possible effects of SQL injection

    SQL injection can lead to a variety of serious issues that can affect the targeted organization as well as its users and customers.

    • Bypass authentication: Through SQLi, attackers can bypass authentication and authorization mechanisms and gain unauthorized access to the system.
    • Data loss or corruption: An attacker can execute database commands that delete or corrupt data. This can destroy critical information and impair the functionality of the application.
    • Data theft: Sensitive data such as personal information, credit card details, passwords and other confidential information can be stolen. This poses a significant risk of identity theft and financial fraud.
    • Legal and regulatory consequences: Data breaches, especially those involving personal information, can lead to legal disputes, penalties and fines, especially under laws such as the GDPR in the EU.
    • Loss of trust: Customer and user trust can be severely damaged, resulting in a loss of business and reputation. Restoring trust can be lengthy and costly.
    • Compromise of other systems: A successful SQL injection attack can serve as a springboard for further attacks on other systems within the network, especially if the database is operated with sensitive system authorizations.
    • Website defacement: In some cases, SQL injection can be used to alter the content of a website, leading to reputational damage and loss of trust.
    • Downtime and business interruption: The need to respond to an attack and secure systems can result in significant downtime that impacts business operations.
    • Recovery and mitigation costs: In addition to direct losses from the attack itself, the costs of forensic investigation, data recovery and enhanced security measures can be significant.
    • Increased attack surface for future attacks: A successful SQL injection may indicate that an application is also vulnerable to other types of attacks.

    How can SQL injections be detected and prevented?

    Tools such as OWASP ZAP can be used to check web applications for security vulnerabilities such as SQL injections. A manual review of the source code for insecure practices, such as including user input directly in SQL queries, can also help identify potential vulnerabilities.

    Expert penetration testers can conduct targeted attacks against an application to uncover vulnerabilities. Monitoring database queries and logs can also help detect unusual or suspicious activity that could indicate SQL injection attacks.

    Prepared statements and parameterized queries are options for separating the code from the data, significantly reducing the possibility of SQL injection. Web application firewalls (WAF) can be configured to recognize and block known SQL injection techniques and patterns.

    All software components involved (web servers, databases, frameworks, libraries) should always be up to date in order to close known vulnerabilities. Strict validation of user input, especially for data used in SQL queries, can also help. This includes checking for expected data types and length restrictions and filtering potentially dangerous characters.

    Better safe than sorry

    Be prepared for potential attacks to actively protect yourself from damage. With the Link11 Zero Touch WAF, you are prepared for all eventualities. If you have any questions about effective protective measures, our colleagues will be happy to help you at any time.

    Contact us now >>

    Everything you need to know about the Log4j vulnerability
    Protecting Web Applications without Disrupting the Business