Researchers from Eioneus discovered one of the most severe SQL injection vulnerabilities found to date, in the Employee Provident Fund Organization’s online portal. With this vulnerability, a malicious user could gain access to the entire Provident Fund database. The flaw was immediately reported to CERT-IN and NIC so that immediate action could be taken.
The bug didn’t just expose database access — it also allowed an attacker to take full control of the UAN servers. Researchers were able to successfully extract data including phone numbers, email IDs, PAN numbers, KYC details, and bank details.
Based on the proof-of-concept and the official communication exchanged between Eioneus and the relevant authorities, it’s clear the researchers used SQLMap to identify the vulnerability.
What is SQLMap?
SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. It comes with a powerful detection engine, a range of niche features aimed at penetration testers, and switches covering everything from database fingerprinting to data extraction, filesystem access, and even executing operating system commands via out-of-band connections. The official project site is sqlmap.org.
What is SQL Injection?
SQL injection is an attack technique where malicious input is embedded into a poorly designed application and passed through to the backend database. That malicious input can then trigger database query results or actions that were never intended to be executed.
In an upcoming post, I’ll cover SQL injection in more depth — its different types, and how to download and set up SQLMap for identifying these vulnerabilities.
References
- Eioneus — eioneus.com
- CERT-IN — cert-in.org.in
Securify 
Leave a comment