I am trying penetration testing for one of my clients.
The platform is Code ignitor.
There is an endpoint
The function queries from the
vehicle table where
1 with no sanity check.
Now I tried Acunetix (scanner) and it found both a blind SQL and normal SQL injection vulnerability on the website. I need to show my client there is actually a flaw, so I used sqlmap with various options.
Like I know the backend DB is mysql,
—skip-WAF and marked
/find/1* with the asterisk marking the injection point.
Sqlmap performed detail evaluation, however couldn’t exploit the vulnerability. I scanned with a higher risk setting (
--risk) and verbose to see the queries myself as well.
What I noticed is that
* is marked as non-permitted character in the config of code ignitor which prevents sqlmap from making
SELECT * FROM [...] etc. queries.
Shall I assume that the website is safe? Since I can see that in the code the sanity check has not been performed on the “input data”.