Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

UpdatedJanuary 16, 2026

•2 min read•View as Markdown

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Cyber Sekler

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Password Reset Poisoning Leading to Account Takeover

Overview During a penetration test of a Web Applications API, I discovered a vulnerability in the password reset functionality that allowed an attacker to intercept reset tokens and take over user accounts. By manipulating a user-controllable field i...

Jan 16, 20262 min read

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

During a web application assessment, I discovered an exposed .git directory that allowed me to download the application's entire source code. By extracting and analysing the git objects, I identified hardcoded credentials that granted admin-level acc...

Dec 16, 20252 min read

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Broken Access Control Leading to Privilege Escalation

Overview During a web application penetration test, I identified a broken access control issue that allowed a low-privileged user to escalate their privileges to administrator. The issue was easy to identify and had a high impact, as it allowed full ...

May 20, 20252 min read

Broken Access Control Leading to Privilege Escalation

Web Application Account Compromise via 2FA Bypass

Overview During a penetration test of a web application, I identified a flawed two-factor authentication implementation that could be bypassed using brute-force techniques. This finding demonstrates that poorly implemented two-factor authentication (...

Jul 9, 20242 min read

Web Application Account Compromise via 2FA Bypass

Cyber Sekler

7 posts

Overview

During a black-box web application penetration test, I identified an unauthenticated SQL injection vulnerability that could be escalated to remote command execution. Although SQL injection vulnerabilities are less common today, this finding demonstrated how severe the impact can still be. The issue allowed unauthenticated attackers to execute operating system commands on the underlying server.

Discovery

While testing the web application from an unauthenticated perspective, I focused on input handling within the login functionality. Testing for SQL injection using basic payloads intended to alter query logic or trigger database errors. These attempts did not return useful feedback. Based on this, I shifted to testing for blind SQL injection using time-based techniques.

I injected a time delay payload into the request and observed the server response consistently matching the specified delay, confirming blind SQL injection.

Example payload used:

WAITFOR DELAY '0:0:10'

To rule out normal latency, I repeated the test multiple times using different delay values. In each case, the response time consistently matched the injected delay, confirming the presence of a time-based SQL injection vulnerability on the login endpoint.

Once the SQL injection was confirmed, I used SQLMap to further validate and demonstrate the impact of the vulnerability. SQLMap was configured to proxy traffic through Burp Suite so that the generated SQL queries could be reviewed.

SQLMap successfully identified the injection point and confirmed database interaction. I briefly enumerated database metadata to demonstrate impact but intentionally avoided dumping sensitive data.

To further assess severity, I used SQLMap’s operating system shell functionality. This allowed the execution of operating system commands through the database using xp_cmdshell. While command execution was slow due to the time-based nature of the injection, it was reliable and confirmed remote command execution on the host.

Example command:

sqlmap -u "https://example.com/" --data "txtUserID=*" --dbms "<database_type>" --os-shell

At this stage, the vulnerability had escalated from an unauthenticated SQL injection to full command execution. I stopped further exploitation after collecting sufficient evidence and notified the customer immediately.

Unauthenticated SQL Injection Leading to Remote Command Execution in a Web Application

Comments

More from this blog

Password Reset Poisoning Leading to Account Takeover

Exposed .git Directory Leading to Source Code Disclosure and Hardcoded Credentials

Broken Access Control Leading to Privilege Escalation

Web Application Account Compromise via 2FA Bypass

Overview

Objective

Discovery

Takeaway

Command Palette

Comments

More from this blog

Overview

Objective

Discovery

Takeaway