I have a parameter (pi_apk_version_code) that seems to be vulnerable to SQL Injection (the team is divided on this). The database column corresponding to this parameter accepts only numeric values. Now, if a payload "; or 1=1" is manually given as input to this parameter, the output is an Oracle error code (ORA-01722: invalid number). The same input when given via a fuzzer does not result in an Oracle error code, but returns the desired results from the query.
- Is this indicative of SQL injection being present?
- If you think SQL injection is present, what are some payloads you will supply to exploit it so that one can be convinced that SQL injection is really present?
SQLmap was run for this and no issues were detected.
PL/SQL Queries in focus (pi_apk_OS and pi_apk_version_code are inputs coming from the client):
SELECT COUNT(1) INTO l_count FROM APK_VERSION_MASTER WHERE apk_OS = pi_apk_OS --AND apk_version_code = pi_apk_version_code AND Status = 'A'; OPEN rc_result FOR SELECT apk_version_code, apk_version_string, (CASE --WHEN pi_apk_version_code < apk_version_code THEN WHEN pi_apk_version_code < lowest_version_code THEN 'Y' ELSE 'N' END) AS is_Mandatory, path, upgrade_playstore, l_error_code return_code, l_error_message return_message FROM APK_VERSION_MASTER WHERE apk_OS = pi_apk_OS AND apk_version_code = (SELECT MAX(apk_version_code) FROM APK_VERSION_MASTER b WHERE b.apk_OS = pi_apk_OS AND Status = 'A');