Although I understand the concept of a SQL injection and have done simple exploits (simple hack challenge sites and stuff) I'm wondering if one of the site run by my employer is vulnerable.
Unlike my previous experience (relating strictly to forms open for injection) it seems as though the site is sending SQL statements via the url. When manipulating the URL of a page (which is in the form of http://site.com/?action=thefaq_question&questionnr=34&categry=10) by replacing the =10 with =* for example I get error output on the page:
Error in SELECT * FROM thefaq WHERE 1 AND thefaq.site=1 AND thefaq.id=* : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '*' at line 1 Error in SELECT * FROM sitecontent WHERE
etc etc, the error goes on quite a bit.
Clearly SQL statements are sent via the URL, but does this make the site vulnerable by definition, i.e. is it possible there is some input validation taking place that would strip any truly malicious SQL statements from the URL before being executed?
As far as I can tell, if the URL processess SQL statements anything goes therefore it is vulnerable but I want to make sure of this before I make a fool of myself when reporting it to my employer.
---- edit ----
Mentioned this to the appropriate manager who didn't seem particularly stressed about it. Explaining that this vulnerability could result defacement or worse: user info and possible passwords being exposed (assuming they are decently hashed is probably wishful thinking) did not impress him. Website is not a priority (nor is diverting any budget to fixing the issue I suppose).
Thx for replies!