I am performing penetration testing on a site. Most of the request are performed by post request in background. When I intercepted one request using Live HTTP Header and replayed it using same parameters as in the original request following error was genetrated(however the original request was successful):
Error: SQLSTATE: Integrity constraint violation: 1048 Column 's_id' cannot be null
SQL Query: INSERT INTO
added_on) VALUES (NULL, 924300, NULL, '2016-09-01 13:28:29')
Notice: If you want to customize this error message, create app/View/Errors/pdo_error.ctp Stack Trace
CORE/Cake/Model/Datasource/DboSource.php line 460 → PDOStatement->execute(array) CORE/Cake/Model/Datasource/DboSource.php line 426 → DboSource->_execute(string, array) CORE/Cake/Model/Datasource/DboSource.php line 1004 → DboSource->execute(string) CORE/Cake/Model/Model.php line 1827 → DboSource->create(UserSLike, array, array) APP/Controller/SController.php line 1584 → Model->save(array) [internal function] → SController->sActivity() CORE/Cake/Controller/Controller.php line 490 → ReflectionMethod->invokeArgs(SController, array) CORE/Cake/Routing/Dispatcher.php line 187 → Controller->invokeAction(CakeRequest) CORE/Cake/Routing/Dispatcher.php line 162 → Dispatcher->_invoke(SController, CakeRequest, CakeResponse) APP/webroot/index.php line 116 → Dispatcher->dispatch(CakeRequest, CakeResponse)
The following request was made with LiveHTTP header
Host: www.xyz.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0 Accept: application/json, text/plain, */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Referer: https://www.xyz.com/Dashboard/ Content-Length: 24 Cookie: live_cookie[support_chat_me]=35dbce45627dcff25cc9c2176e0d2085a; CAKEPHP=96abc64p54s524dgrj6injsfx5; __tawkuuid=e::xyz.com::C8WeiSHNj53hAYU545QNvyDPV+tNvx0+usD3q564jk2EenfhtToWQj0BER7V7cqG::2; Tawk_56497b21458b0ebc5e6d22b6=vs17.tawk.to:443::0; __auc=943798cd156cf1c4684725d7a45; PHPSESSID=kjk7fsap9kk25ib182euqfqk71; AWSELB=213575250CC01012FFAB662292465465sldfjJDHFN8A45F10D97D09300BDA1AF5D7A0DA8E6C1C41D40BC34DD2C2E0SDnskjdh Dlkf5FD6A5E;
The s_id and status variable was send through post request however the server is responding with database error as if null variable was send. This only happens when individual request through LiveHTTP header or Burp is send. Is this database vulnerable to some sort of error based SQL injection ?
$_POST['s_id'](assuming you're using php). But you have to sanitize before using it in your request.
PDOStatement->execute(array)which is relatively safe from SQL first order injection. But you shoud look after second order injection ! We can not give you more informations without more code.