154 – Time-based SQL Injection
Description
In a time-based attack, someone could inject a SQL command to the server with code to force a delay in the execution of the queries or with a heavy query that generates this time delay. Depending on the time response, it is possible to deduct some information and determine if a vulnerability is present to exploit it.
Impact
- Allow an attacker to interfere with the queries that an application makes to its database. - Retrieve information from the database an even extract data. - Affect the authentication and authorization aspects of the application. - Steal sensitive information stored in databases.
Recommendation
- Use of prepared statements (with parameterized queries). - Use of stored procedures. - Enforcing the least privilege.
Threat
Anonymous attacker from an intranet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X