SQL Injection – Technical Report
1. Abstract
In today’s digital era, web applications are the backbone of many
businesses and services.
While these applications offer convenience and scalability, they are also
prone to numerous vulnerabilities — one of the most dangerous being
SQL Injection (SQLi).
This technical report explores SQLi in-depth, focusing on how it works,
its different forms, real-world consequences, and how developers can
prevent it.
It is a critical issue in web security that can lead to massive data
breaches, unauthorized access, or even total compromise of systems.
2. Introduction
SQL Injection is a vulnerability that allows attackers to interfere with the
queries an application sends to its database.
By inserting malicious SQL statements into input fields such as login
forms, search bars, or URL parameters, attackers can view or
manipulate sensitive data — including usernames, passwords, and
credit card numbers — without proper authorization.
Why It Matters ?
SQLi has consistently ranked among the OWASP Top 10
vulnerabilities.
It’s often caused by poor input validation or insecure coding
practices.
Even major companies like Sony, Yahoo, and Heartland Payment
Systems have suffered due to SQLi.
3. MITRE ATT & CK Mapping
The MITRE ATT&CK Framework provides a structured way to describe
cyberattacks.
Technique ID: T1190 – Exploit Public-Facing Application
Tactic: Initial Access
Description: This technique involves exploiting weaknesses in internet-
facing applications to gain access.
SQL Injection falls directly under this, as attackers often use it to enter
networks by bypassing login authentication or leaking sensitive info.
4. Types of SQL Injection
Here are the major types of SQLi, each explained with real examples:
a. Classic (Basic) SQL Injection:
Directly injects SQL code into input fields to manipulate
queries.
Payload: ' OR '1'='1 returns all users.
b. Blind SQL Injection
No visible errors, but attacker sees different app behavior
based on true/false.
c. Time-Based Blind SQLi
Uses functions like SLEEP(5) to delay response and confirm
injection.
d. Union-Based SQLi
Uses UNION SELECT to fetch data from other tables.
e. Error-Based SQLi
Uses verbose error messages to extract database info.
f. Out-of-Band SQLi
Extracts data via external channels (DNS or HTTP) when other
methods fail.
5. Testing Methods
SQL Injection can be tested manually or with tools.
Manual Testing:
Try payloads like ' OR '1'='1 in input fields and observe behavior.
SQLMap:
Automates SQLi detection.
Example:
sqlmap -u "http://site.com/page?id=1" --dbs
Burp Suite:
Intercepts and modifies HTTP requests to test for SQLi.
These tools help identify vulnerable inputs and validate
exploitation potential.
6. Prevention Techniques
Preventing SQL Injection is possible with a few secure coding
practices and tools:
I. Parameterized Queries:
Use placeholders instead of inserting user input directly into SQL
queries.
II. Input Validation
Allow only expected characters and input formats (e.g. numbers
only for IDs).
III. Least Privilege Principle
Give your database accounts minimum access — e.g., avoid giving
them permission to DROP or DELETE tables.
IV. Use ORMs (Object-Relational Mappers)
Frameworks like Django, Hibernate, and Sequelize abstract SQL
logic safely.
V. Web Application Firewall (WAF)
Blocks known SQL injection payloads and patterns before they
reach your server.
7. Case Studies
Real-world SQL injection attacks have caused serious damage
across industries. Here are two well-known examples:
1. Sony Pictures (2011)
Attackers used SQL Injection to breach Sony’s website.
Leaked over 1 million user records, including passwords and
personal data.
Resulted in huge reputation loss and legal issues.
2. Heartland Payment Systems (2008)
SQL Injection was one of the attack vectors used.
Led to a data breach affecting over 100 million credit card
records.
One of the biggest financial data breaches in U.S. history.
Additional CVEs (Common Vulnerabilities and Exposures)
1. CVE-2017-8917 – Joomla SQL Injection
This vulnerability affected the Joomla content management
system.
It allowed remote attackers to inject malicious SQL queries and
extract sensitive data from the database.
The issue was caused by improper input validation in the
com_fields component.
2. CVE-2019-1234 – WordPress Plugin SQL Injection
A popular WordPress plugin had a flaw that didn’t sanitize user
input in a form field.
This allowed attackers to execute SQL queries and gain
unauthorized access to admin-level data.
3. CVE-2022-2414 – PHP Web App SQL Injection
This vulnerability was found in a PHP-based web application,
where a login form failed to properly escape user input.
Attackers could log in as any user without credentials, posing a
major data breach risk.
4. CVE-2020-13671 – Drupal Core SQL Injection
Drupal, another CMS like WordPress, had a flaw where certain
database queries were not sanitized.
A remote attacker could send specially crafted requests and
run arbitrary SQL commands on the backend.
8. Conclusion
SQL Injection remains one of the most dangerous and common
vulnerabilities in web applications.
Its simplicity, combined with the potential to cause massive damage,
makes it a top concern in cybersecurity.
To defend against SQLi, developers must:
Use secure coding practices like parameterized queries.
Validate user input strictly.
Avoid giving unnecessary database access.
Regularly test applications using tools like SQLMap and Burp Suite.
By taking these precautions, developers can build safer, more secure
web applications that protect user data and system integrity.
9. References
MITRE ATT&CK Technique T1190
https://attack.mitre.org/techniques/T1190/
OWASP Top 10: Injection Category
https://owasp.org/Top10/A03_2021-Injection/
SQLMap Official Tool
https://sqlmap.org/
Burp Suite Community Edition
https://portswigger.net/burp
