During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the parameter a NULL value, &page=, it returns the following error.

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-30, 30) AS `UserDocuments` LEFT OUTER JOIN `tasks` AS `Tasks` ON `UserDocuments` at line 1

While if I input ` at the end of value, page=1` it returns the following error

Undeclared variable: NaN","sql":"SELECT `UserDocuments`.*, `Tasks`.`id` AS `Tasks.id`, `Tasks`....

I have the following questions in my mind: I have tried exploiting it but am unable to do so. How can I exploit this parameter as it is returning a syntax error? Also if it is not exploitable is it still vulnerable to SQL injection or some attack?

Please note that it is a GET request and the response is in JSON, while the application is developed on PHP.

  • Do you have the source code ? If it's open source the code may be available on Github or from the maintainer's website. Then you could easily add a few echo to display the SQL statement and figure out how the arguments are parsed. Not every flaw is exploitable though.
    – Kate
    Commented May 3, 2020 at 9:29
  • Assuming this is your application: this is really difficult to debug without having the code or a working sample to play with. Have a look at a tool called sqlmap, which you can fire at the URL and get it to do the SQL injection for you. If it works, increase the debugging level and work out what's a functional injection URL. From what you showed, it looks possible.
    – Pedro
    Commented May 4, 2020 at 10:31
  • I am actually testing a web app and i need to create a proof of concept for this. I agree its very difficult to understand without a proper code.
    – Mike Vonar
    Commented May 4, 2020 at 17:14


You must log in to answer this question.

Browse other questions tagged .