SQL Injection Lab Report
PortSwigger Lab: SQL injection attack, listing the database contents on Oracle
Task: To solve the lab, log in as the administrator user.
Vulnerability Name: SQL Injection
Synopsis
The PortSwigger Web Security Academy lab's web application named "We Like To Shop" contains SQL
Injection Vulnerability found in category filter. The vulnerability occurs when user click on any category that
reflects on the URL as it is. The value of category parameter directly applies in SQL query without validating.
From this we can say that any user can alter URL as per they need. Here the attack happens.
Attacker can inject SQL Queries into parameter to get all information from database which includes all tables
with their column names. Using this database entire information, attacker can go further and fetch the actual
sensitive data too, like admin's username and password directly from the users table, and use it to log in as
administrator without any restrictions / permissions.
CVSS Score
CVSS Score: 9.8 (Critical)
CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
Severity Rating: Critical
Impact
● From this attack, attacker can not just learn database structure but actually extract real admin username
and password, and use it to log in and take control of administrator account.
● By using database structure, attacker can find more deep credentials of any user/customer or
administrator, and steal user data.
● This may leads to major consequences in the business including lost trust of customer, reputational
damage of company, and penalty as per data privacy laws.
Recommendation Suggestions
● Use parameterized queries / statements – Use placeholders (like ?) instead of directly inserting user
input into SQL queries, keeping code separate from data.
● Vulnerable filter category – Apply the same fix (parameterized queries) to the category filter
parameter.
● Input Validation – Check that the user's input matches an allowed value (e.g., a valid category name)
before using it in the query, blocking any unexpected or malicious input.
References
● PortSwigger Web Security Academy – SQL injection:
[Link]
● Standard: Common Vulnerability Scoring System (CVSS) v3.1:
[Link]
● OWASP – 5th Injection includes SQL Injection:
[Link]
Proof of Concept (PoC)
PoC Note
We verified the vulnerability using Burp Suite by manually inserting SQL injection payloads into the category
parameter. Because the application accepted these modified requests without any validation, it confirmed that
user input is passed directly into the SQL query.
Steps
1. Clicked the category filter on the shop's homepage and observed the URL
2. Sent the captured request to Burp Repeater for manual modification.
3. Injected a single quote and comment (category='--) to to check that we can inject any malicious SQL
query. It supposed as comment
Request:
GET /filter?
category=Pets'+UNION+SELECT+USERNAME_LUXPWP,PASSWORD_KLAONT+FROM+USERS_GGV
CHT-- HTTP/2
Host: [Link]
Cookie: session=Mz0pHUHciDIJtsCXHVJmcvVhUm8A3Up3
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
Referer: [Link]
Response:
HTTP/2 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 9590
<tr>
<th>administrator</th>
<td>d94sdhmv1xf8as7mxzjf</td>
</tr>