Vulnerability Management Report
Blind SQL Injection (Time-Based)
1. Vulnerability Details
Vulnerability Name Blind SQL Injection (Time-Based)
Vulnerability Type CWE-89: Improper Neutralization of Special Elements used in an SQL
Command ('SQL Injection')
Severity Critical [CRITICAL RISK]
OWASP Top 10 A03:2021 – Injection
Target URL [Link]
Exposed Artifact User ID parameter (id GET parameter)
2. Vulnerability Description
The Blind SQL Injection module is vulnerable because the application uses user-supplied input from the
User ID field to construct dynamic SQL queries without proper sanitization or parameterization.
Unlike classic SQL Injection, this is a Blind variant — the application does not return database errors or
direct query results. However, it is still exploitable using Time-Based techniques. The payload 1' AND
SLEEP(5) # causes a deliberate 5-second delay in the database response, proving that the backend is
executing attacker-controlled SQL code.
3. Proof of Concept (PoC) Steps
• Step 1: Navigate to [Link]
• Step 2: Enter the following payload in the User ID field:
SQL
1' AND SLEEP(5) #
• Step 3: Submit the request.
• Step 4: Observe that the page takes approximately 5 seconds to load (visible in Network
tab).
Result: Successful confirmation of Time-Based Blind SQL Injection. The response “User ID is
MISSING from the database.” is returned after the delay.
4. Business & Technical Impact
Although data is not directly visible on the page, this vulnerability is still Critical.
An attacker can:
• Extract the entire database structure, table names, and column names.
• Dump sensitive data (usernames, password hashes, admin credentials) character by character.
• Identify database version, current user, and privileges.
• Potentially achieve remote code execution if the database user has sufficient privileges.
This vulnerability is highly dangerous in real environments because it can be automated using tools
like sqlmap, allowing full database compromise even when error messages are suppressed.
5. Remediation & Mitigation Strategies
Immediate Actions (Within 24 Hours)
• Switch DVWA security level to High.
• Temporarily disable the Blind SQL Injection module.
Short Term Actions (1–7 Days)
• Implement Prepared Statements / Parameterized Queries for all database interactions.
• Enforce strict input validation and type casting (e.g., intval($id) in PHP) for numeric fields.
• Use an Object-Relational Mapping (ORM) library with safe defaults.
Long Term Actions
• Remove all dynamic SQL query construction using string concatenation.
• Implement Web Application Firewall (WAF) with strong SQL Injection detection.
• Enable proper logging and monitoring for anomalous query response times.
• Follow OWASP SQL Injection Prevention Cheat Sheet.
• Conduct regular DAST and manual penetration testing.