Database Error Error: SQLSTATE[23000]: Integrity constraint violation. Is it vulnerable to SQLi?

Question

I am performing penetration testing on a site. Most of the request are performed by post request in background. When I intercepted one request using Live HTTP Header and replayed it using same parameters as in the original request following error was genetrated(however the original request was successful):

Database Error

Error: SQLSTATE[23000]: Integrity constraint violation: 1048 Column 's_id' cannot be null

SQL Query: INSERT INTO a2.user_s_likes (s_id, user_id, status, added_on) VALUES (NULL, 924300, NULL, '2016-09-01 13:28:29')

Notice: If you want to customize this error message, create app/View/Errors/pdo_error.ctp Stack Trace

CORE/Cake/Model/Datasource/DboSource.php line 460 → PDOStatement->execute(array)
CORE/Cake/Model/Datasource/DboSource.php line 426 → DboSource->_execute(string, array)
CORE/Cake/Model/Datasource/DboSource.php line 1004 → DboSource->execute(string)
CORE/Cake/Model/Model.php line 1827 → DboSource->create(UserSLike, array, array)
APP/Controller/SController.php line 1584 → Model->save(array)
[internal function] → SController->sActivity()
CORE/Cake/Controller/Controller.php line 490 → ReflectionMethod->invokeArgs(SController, array)
CORE/Cake/Routing/Dispatcher.php line 187 → Controller->invokeAction(CakeRequest)
CORE/Cake/Routing/Dispatcher.php line 162 → Dispatcher->_invoke(SController, CakeRequest, CakeResponse)
APP/webroot/index.php line 116 → Dispatcher->dispatch(CakeRequest, CakeResponse)

The following request was made with LiveHTTP header

Host: www.xyz.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Referer: https://www.xyz.com/Dashboard/
Content-Length: 24
Cookie: live_cookie[support_chat_me]=35dbce45627dcff25cc9c2176e0d2085a; CAKEPHP=96abc64p54s524dgrj6injsfx5; __tawkuuid=e::xyz.com::C8WeiSHNj53hAYU545QNvyDPV+tNvx0+usD3q564jk2EenfhtToWQj0BER7V7cqG::2; Tawk_56497b21458b0ebc5e6d22b6=vs17.tawk.to:443::0; __auc=943798cd156cf1c4684725d7a45; PHPSESSID=kjk7fsap9kk25ib182euqfqk71; AWSELB=213575250CC01012FFAB662292465465sldfjJDHFN8A45F10D97D09300BDA1AF5D7A0DA8E6C1C41D40BC34DD2C2E0SDnskjdh Dlkf5FD6A5E;

s_id=12536&status=1

The s_id and status variable was send through post request however the server is responding with database error as if null variable was send. This only happens when individual request through LiveHTTP header or Burp is send. Is this database vulnerable to some sort of error based SQL injection ?

Answer 1

The error Database Error Error: SQLSTATE[23000]: Integrity constraint violation itself means that the column 's_id' could be a primary key and because of that, the system is not allowing it to be null. The details posted above cannot give a definitive answer whether the application is vulnerable to SQL injection or not.

Answer 2

Most likely not, because you received the default error page of CakePHP. The error indicates that the request either is missing data (hence resulted in NULL values) or the referenced data (s_id) could not be found (you'll need to look at the SController.php file).

There could only be an injection if the developer circumvented the default database generator of CakePHP (which generates database schema, models and CRUD statements) and made a custom PDO statement.

Answer 3

You cannot determine if the parameter is vulnerable to SQLi based on this error alone. For more definitive proof, you need to manipulate the s_id parameter and see if you can get it to return a syntax error. This would indicate that the input of s_id is not being properly sanitized or parameterized.

Since the error message is showing you the SQL query, this is rather easy to test for. Try doing some of the following injections:

---

s_id=1,1,1&status=1

Query becomes: INSERT INTO a2.user_s_likes (s_id, user_id, status, added_on) VALUES (1,1,1, 924300, NULL, '2016-09-01 13:28:29')

If vulnerable, you would expect to get an error about too many arguments / parameters.

---

s_id=1)&status=1

Query becomes: INSERT INTO a2.user_s_likes (s_id, user_id, status, added_on) VALUES (1), 924300, NULL, '2016-09-01 13:28:29')

If vulnerable, you would expect to get an error message about an unexpected parenthesis.

---

s_id=1'&status=1

Query becomes: INSERT INTO a2.user_s_likes (s_id, user_id, status, added_on) VALUES (1', 924300, NULL, '2016-09-01 13:28:29')

If vulnerable, you would expect to get an error message about an unterminated literal string.

---

If you receive error messages about s_id having an incorrect data type / not being a number, then this would imply that the query is being parameterized and thus is not vulnerable.

In order to prove that an SQL injection vulnerability exists, you need to prove that the value of s_id is being interpreted as SQL. Syntax errors are the easiest way to do this.