Vega shows SQL injection vulnerablity but sqlmap says no

Question

I'm pen testing an application. The URL is basically app.php?app=appname. If app exists it gives correct output, but if it doesn't exist we get a internal server error 500.

Vega detects it as a SQL injection vulnerability, but when I test it with sqlmap it cannot find injection in this url. Vega shows the URL app.php?app=appname'%20AND%201=2%20--%20, but it also gives the same internal error.

In this case is it really a SQL injection vulnerability? Can I force sqlmap to use this URL as a help?

Answer 1

If the application is querying a database for appname, then most likely you have a SQL injection. To test the url with sqlmap run the command:

sqlmap -u "app.php?app=appname" -p "app"

Here is a quick cheat sheet to protect yourself from SQL injection.

Answer 2

It's possible that their could be some blind (time-based) SQL injection vulnerabilities present, you may not have "gone deep enough" with SQLMap. By default, SQLMap does not attempt all SQLi methods. You can try specifying the risk level (2):

Risk

Option: --risk

This option requires an argument which specifies the risk of tests to perform. There are four risk values. The default value is 1 which is innocuous for the majority of SQL injection points. Risk value 2 adds to the default level the tests for heavy query time-based SQL injections and value 3 adds also OR-based SQL injection tests.

Or Perform a simple time-based test like this:

Seconds to delay the DBMS response for time-based blind SQL injection

Option: --time-sec

It is possible to set the seconds to delay the response when testing for time-based blind SQL injection, by providing the --time-sec option followed by an integer. By default it's value is set to 5 seconds.

SQLMap Help