SQL Injection and Database Exfiltration with sqlmap

Web Application Security | SEC504 | Jul 2026

The /kb documentation search takes entityid and search parameters. Appending a single quote to search returned a MariaDB 1064 syntax error, confirming injection by hand before any tool. sqlmap then tested both parameters, found entityid not injectable and search injectable via four techniques (boolean-blind, error-based, time-based, and a 3-column UNION), and identified the backend as MySQL/MariaDB. Walking the ladder: --dbs listed information_schema and support; -D support --tables listed chat, contact, kb, tickets, users; and -D support -T users --dump pulled 12 users with roles (sme, admin, audit) and password hashes, one of which sqlmap cracked inline to Password123.

Tools: sqlmap 1.5.2, curl / browser, Slingshot Linux

Commands

1. Confirm by hand

Appending a single quote to the search parameter (search=RAG') returned '1064, You have an error in your SQL syntax ... MariaDB' directly on the page. A one-character manual probe confirms the injection before sqlmap is ever launched, and tells you the backend is MySQL/MariaDB.

# /kb?entityid=3487&search=RAG'

A single quote breaks the query -> 1064 syntax error = confirmed SQLi

2. Characterize with sqlmap

sqlmap tested both parameters. entityid was not injectable; search was, via boolean-based blind, error-based (FLOOR/EXTRACTVALUE), time-based blind (SLEEP), and a 3-column UNION query. It confirmed the backend as MySQL >= 5.0 (MariaDB fork) and stored the session so later runs resume instantly.

sqlmap -u "http://support.falsimentis.com/kb?entityid=3487&search=RAG"

sqlmap tests each parameter and reports which is injectable and how

3. Enumerate databases

--dbs listed the available databases: information_schema (always present) and support (the application's). This is the top rung of the enumeration ladder.

sqlmap -u "..." --dbs

--dbs: list databases; support is the app's

4. Enumerate tables

-D support --tables listed chat, contact, kb, tickets, and users. The users table is the obvious next target for credential recovery.

sqlmap -u "..." -D support --tables

-D <db> --tables: list tables in the chosen database

5. Dump the users table

-D support -T users --dump recovered 12 users with names, emails, usernames, roles (sme, admin, audit), and password hashes. sqlmap recognized the password column as hashes and cracked one inline, annotating it (Password123). Full credential and role disclosure from a single quote in a search box.

sqlmap -u "..." -D support -T users --dump

--dump: extract the table; sqlmap offers to crack recognized hashes

Key Findings

A single quote in 'search' returned a MariaDB 1064 error (manual confirmation)
sqlmap found 'search' injectable via 4 techniques; 'entityid' was not injectable
Enumerated support DB tables: chat, contact, kb, tickets, users
--dump recovered 12 users with roles (sme/admin/audit) and password hashes
sqlmap cracked one hash inline to Password123

Security Controls

Parameterized queries / prepared statements
Least-privilege database account
Slow salted password hashing (bcrypt/argon2)
Generic error handling (no SQL errors to the client)
Per-parameter injection testing and WAF coverage