Burp Suite User Forum

Create new post

Missing identification of SQL injection

Maurizio | Last updated: Jun 09, 2015 11:00AM UTC

Dear Sir, we identified a missing identification of Blind SQL injection on some specific parameter. The SQL injection is presented on a single parameter of a POST request. Like par=pluto par=pluto -> result A par=pippo -> blank page par=pluta -> blank page par=pl'||(SELECT+CHR(117))||'to -> result A par=pl'||(SELECT+CHR(116))||'to -> blank page The DB is a PostgreSQL 9.4.1 Regards. inode

PortSwigger Agent | Last updated: Jul 09, 2015 08:12AM UTC

Thanks for this feedback and apologies for the slow reply. We have this potential improvement in our backlog of work and we 're going to look into how Burp can reliably automate the detection of SQL injection using this technique.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.