Unauthenticated Oracle Boolean-Based SQL Injection Through a Legacy Search Filter
An unauthenticated boolean-based SQL injection was identified in a legacy Oracle-backed web application. A non-correlated scalar subquery was used to turn an Oracle error into a reliable boolean oracle, enabling character-by-character extraction of database metadata and any data accessible to the application account. The report was accepted as Critical with CVSS 10.0 and rewarded with €1,000.
Description
A legacy search endpoint inserted a client-controlled type filter directly into an Oracle SQL statement. The endpoint sat behind an SSO gateway, but a routing mismatch allowed a request that looked like a static resource at the edge to be normalized and dispatched as a dynamic handler by the backend. The application also accepted a client-supplied identity header without establishing a real authenticated session.
The SQL injection itself was straightforward string concatenation, but obtaining a reliable signal required a less conventional approach. The normal query intentionally returned no rows for the supplied search criteria. As a result, predicates evaluated only at row level were never reached, which made common boolean payloads appear ineffective.
The solution was to place the attacker-controlled condition inside an uncorrelated scalar subquery at the top-level AND filter. Oracle evaluated this subquery as a startup filter before scanning the empty result set:
- The true branch returned the scalar value
1. - The false branch executed a subquery known to return multiple rows.