Application is vulnerable to SQL injection
An attacker with access to the vulnerable pages could manipulate the queries being sent to the database, potentially enabling them to extract sensitive information, including (but not limited to) authentication credentials and personal details. Such information could be sold by the attacker to other malicious individuals, used in other attacks (as the same password is often used across systems) or released publicly to damage the organisation’s reputation. The attacker could also modify content within the application, potentially adding malicious code to the application, which could then be used to deliver malware or exploit issues within client browsers. In this particular instance, exploitation was more difficult as the results of the attack had to inferred based on the pages returned, often referred to as “blind” SQL Injection.
