What HTTP status codes indicate that there is a SQLi vulnerability?

Question

In this blogpost describing a pentest, the author adds ' to a field requiring some value, and concludes that there is an SQLi vulnerability:

Upon further investigation adding a single quote would make the server return a 500 status error, which.... SCREAMS SQLi

Does an HTTP 500 code mean it is vulnerable to SQLi? Or do all HTTP error codes mean it is an SQL injection? Which HTTP code do not mean an SQLi?

Answer 1

There are no error code for sql injections. HTTP status code 500 just means an internal server error. When being able to break the code by just adding some special characters, the code is vulnerable to a SQL injection as the input is not sanitized,

For example:

$sql = "SELECT * FROM mytable WHERE name = '$name'";

When adding "Jose's" into the field, the SQL statement would be:

$sql = "SELECT * FROM mytable WHERE name = 'Jose's'";

which would be an error in the syntax.

If the input is not sanitized you could now add additional SQL statements after the ' and therefore run your own sql statements.

Answer 2

Does an HTTP 500 code mean it is an SQLi?

A 500 error code means Internal Server Error. Please take a look here for HTTP status codes and their meanings. A 500 code in this case (when adding a single quote) does not neccessarily mean that it is an SQLi, because it can have other causes (bad SQLi prevention, other parsing issues). But chances are really good, that it is an SQLi!

or do all HTTP error codes mean it is an SQL injection?

No. For example a 400 (Bad Request) could be given, as single quotes are not permitted. This could indicade that an SQLi is prevented (in a dirty way).

Which HTTP code do not mean an SQLi?

That's never sure, because SQLi prevention usually escapes the string and stores it in the database, while everything is working normal an no exceptions are thrown. So in both cases (SQLi and prevented SQLi) the response code could be 200 (OK).

Answer 3

Let's say the URL looks like this:

http://anysite.com/somefile.php?id=1

And the query becomes:

SELECT * FROM product WHERE id='1'

Now, when you try to inject the single quote in it like this:

http://anysite.com/somefile.php?id=1'

Then the query becomes this:

SELECT * FROM product WHERE id='1''

But here you put the single quote in it so it will return the syntax error always. Because database can not fulfil the query so it will return the syntax error. Note point is database is returing the error not the server. So, there is no relation between the 500 server error to the SQL error.

Note: Developers can hide the syntax error by using the @ or use of some other, so that you can not see the syntax error. Then, blind SQL comes to the rescue.