Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I scanned my site for Vulnerabilities I found this error.

Various SQL errors were disclosed within the application source code or other files.

I have checked for sql injection and confirmed that it's not injectable.So how severe is this vulnerability? How an attacker could exploit it?

share|improve this question
    
sounds like nessus? –  that guy from over there Sep 4 '13 at 8:19
add comment

3 Answers

up vote 4 down vote accepted

Not all SQL errors can be exploited, however you need to investigate why the SQL error was generated. Often it's a sign of bad input validation, even when not exploitable (by you) it should be fixed. Furthermore, in production environments, error messages should be generic and not disclose any details about the error or your system's configuration.

share|improve this answer
add comment

The main risk of SQL errors being displayed is that if the input is vulnerable to SQL injection, it makes life far FAR easier for an attacker. They can input bad queries and the error message will tell them the source of the problem and thus give them information about the database. If the query that is erroring can not be altered by any user input, or the input is truly completely validated, then it shouldn't be exploitable, but it's still best practice to avoid showing errors directly so that any future exploit can't utilize it to get information about the database.

share|improve this answer
add comment

Which vulnerability scanner did you use, as I know a lot of them show up as false-positives (not exploitable but still need to be addressed as a lot of the time it can give out private information such as schema information, user information, etc).

Also if you want to and is applicable, it may be an idea to run SQLMap or SQLNinja on it and see what it comes up.

Alternatively, you could always write your own payload.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.