Description

This detector tests URL parameters with defined payloads and analyzes server responses for database error messages. When a web application fails to properly validate input parameters and exposes SQL error messages, it indicates a potential missing validation vulnerability that could allow attackers to manipulate database queries and access sensitive data.

Detection Strategy

• The detector extracts all query parameters from the target URL

• Each parameter is individually replaced with a SQL injection test payload

• HTTP requests are sent to the modified URLs with the test payloads

• Server responses are examined for SQL error message patterns (database error strings, syntax errors, etc.)

• A vulnerability is reported when any response contains recognizable SQL error messages, indicating the application is not validating the input correctly

• Skipped entirely when the initial GET response is 4xx/5xx, mirroring probes' behavior (this method is not in probes' _METHODS_BYPASS_4XX allowlist)

• Only the first 25 query parameters are probed to bound request fan-out against the target

• Each vulnerable parameter produces a distinct evidence entry naming the parameter (not the mutated URL, to avoid leaking other query values) so multiple injectable parameters on the same host don't collapse into one fingerprint